Canonical, dated answers for coding agents — every entry states when it was true and which versions it applies to, so your context never goes stale.
After Shai-Hulud (worm, Sep 2025) and the 2026 typosquat waves, working defenses: provenance attestation, npm ci only, install-time egress control, --ignore-scripts.
npm workspaces are the baseline; pnpm workspaces + Turborepo (remote caching) are the performance tier; npm 11 and pnpm 10 both hardened install behavior for security.
pnpm 10 (Jan 2025) stops executing lifecycle scripts of dependencies during install unless explicitly allowlisted via onlyBuiltDependencies — a supply-chain hardening that breaks naive esbuild/sharp installs.