Malicious versions of Nx and some supporting plugins were published

Periodic reminder to disable npm install scripts.

    npm config set ignore-scripts true [--global]

It's easy to do both at project level and globally, and these days there are quite few legit packages that don't work without them. For those that don't, you can create a separate installation script to your project that cds into that folder and runs their install-script.

I know this isn't a silver bullet solution to supply chain attakcs, but, so far it has been effective against many attacks through npm.

https://docs.npmjs.com/cli/v8/commands/npm-config

Or use pnpm. The latest versions have all dependency lifecycle scripts ignored by default. You must whitelist each package.

pnpm is not only more secure, it's also faster, more efficient wrt disk usage, and more deterministic by design.

It also has catalogs feature for defining versions or version ranges as reusable constants that you can reference in workspace packages. It was almost the only reason (besides speed) I switched a year ago from npm and never looked back.

workspace protocol in monorepo is also great, we're using it a lot.

OK so it seems too good now, what are the downsides?

Personally, I didn't find a way to create one docker image for each of my project (in a pnpm monorepo) in an efficient way