Articles Tagged "Security"

npm vs pnpm vs Yarn vs Bun: Who Actually Protects You From the Supply Chain?

npm spent June announcing it will finally stop running install scripts by default. pnpm users shrugged, they have had it since early 2025. Here is the scoreboard npm left out, and the exact settings that harden all four package managers.

8 min read

You Approved That npm Package. Do You Have Any Idea What It Does?

You just told npm that fsevents is allowed to run code on your machine. Be honest, you have no idea what it does, and you never will. Here is how to decide what to trust when you cannot read the code, from a five-second gut check to cryptographic proof.

7 min read

npm Just Stopped Trusting Your Dependencies, and That Is a Good Thing

For fifteen years, npm install meant silently running code from hundreds of strangers. That default is dead. The quiet npm warn line in your terminal is the biggest shift in JavaScript dependency handling in a decade, and here is what it actually means.

6 min read

GDPR and nDSG Compliance Checklist for Swiss E-Commerce

A practical compliance checklist for Swiss e-commerce businesses navigating both the EU GDPR and Switzerland's new Data Protection Act (nDSG).

7 min read