
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Fast, disk space efficient package manager
Features:
shrinkwrap.yaml.package.json.Like this project? Let people know with a tweet.
pnpm uses hard links and symlinks to save one version of a module only ever once on a disk.
When using npm or Yarn for example, if you have 100 projects using the same version
of lodash, you will have 100 copies of lodash on disk. With pnpm, lodash will be saved in a
single place on the disk and a hard link will put it into the node_modules where it should
be installed.
As a result, you save gigabytes of space on your disk and you have a lot faster installations!
If you'd like more details about the unique node_modules structure that pnpm creates and
why it works fine with the Node.js ecosystem, read this small article: Why should we use pnpm?
Using a standalone script:
curl -L https://unpkg.com/@pnpm/self-installer | node
Via npm:
npm install -g pnpm
Once you first installed pnpm, you can upgrade it using pnpm:
pnpm install -g pnpm
Do you wanna use pnpm on CI servers? See: Continuous Integration.
Just use pnpm in place of npm. For instance, to install run:
pnpm install lodash
For more advanced usage, read pnpm CLI on our website.
For using the programmatic API, use pnpm's engine: supi.
npm has a great package runner called npx.
pnpm offers the same tool via the pnpx command. The only difference is that pnpx uses pnpm for installing packages.
The following command installs a temporary create-react-app and calls it, without polluting global installs or requiring more than one step!
pnpx create-react-app my-cool-new-app
pnpm is faster than npm and Yarn. See this benchmark which compares the three package managers on different types of applications.
Here are the benchmarks on a React app:
FAQs
Fast, disk space efficient package manager
We found that pnpm1 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.