pnpm 11.10 was released over the weekend as a small update that includes several supply chain hardening changes. The main change is a new way to configure registry authentication that keeps a repository's own files from redirecting your registry token to a different host. The release also tightens a few build and packaging commands and adds an install path for pnpm v12, the Rust rewrite.

The new _auth setting ties each token to its registry#

pnpm 11.10 adds an _auth setting that stores registry credentials in one structured value, keyed by registry URL. It can be set in pnpm's global config or, for CI, in a pnpm_config__auth environment variable.

The security benefit is that the credential and the host it belongs to travel together, and pnpm reads _auth only from the environment or the global config, never from a project's files. That means a malicious or compromised pnpm-workspace.yaml or .npmrc inside a repository cannot point a valid token at a different host. A tampered project file is a common way attackers get a foothold, and redirecting a registry token is a direct route to stealing it, so closing that path removes exposure.

This also resolves a problem pnpm created in June, when it stopped expanding environment variables in registry credentials set from project files like .npmrc, closing a path a malicious repo file could abuse. That hardening broke authentication for teams that were legitimately using environment variables in .npmrc for private registries, and _auth is the sanctioned replacement.

pnpm v12, the Rust port, is now installable#

Outside the security work, 11.10 adds an install path for pnpm v12, the Rust port. pnpm has been rewriting its installation engine in Rust to make installs faster and cut the overhead of the current Node.js implementation, and v12 is the first version to carry that work. It is still pre-release, but pnpm self-update next-12 will now install and link it from the next-12 tag. Because v12 ships as a native binary with no Node.js launcher, it starts without the Node.js startup cost that pnpm pays on every command today. From v12 on, updates settle on the standard pnpm package, now the Rust executable.

Other hardening in the release#

Several smaller changes follow the same theme of limiting what an attacker who controls a repository's files can do. pnpm deploy and pnpm pack-app now reject output paths that point outside the project. pack-app looks for macOS code-signing tools outside the project, so a repository cannot swap in its own signer. A prototype pollution hazard tied to a dependency named __proto__ was fixed. pnpm also stopped passing upstream registry credentials to install-accelerator servers, and added a new Node.js release signing key so runtime downloads keep verifying correctly.

This continues a direction pnpm has been moving for several releases. pnpm 10 stopped running dependency lifecycle scripts automatically, and pnpm 11 turned on a one-day minimum release age and began blocking exotic subdependencies by default. With 11.10, pnpm is doing more of the work of enforcing supply chain security, beyond just resolving and installing dependencies.