Verify latest release
pnpm version
11.6.0
Which area(s) of pnpm are affected? (leave empty if unsure)
CLI
Link to the code that reproduces this issue or a replay of the bug
pnpm setup
Reproduction steps
Just run this command pnpm setup
Describe the Bug
Why does pnpm require allowing builds for its own build? Because pnpm self-update didn’t ask for it. Only pnpm setup asks. It seems suspicious.
Expected Behavior
Even if pnpm has its own build step, it must not ask for permission. It feels like someone has pushed postinstall script malware to pnpm.
Which Node.js version are you using?
24.15.0
Which operating systems have you used?
If your OS is a Linux based, which one it is? (Include the version if relevant)
No response
Verify latest release
pnpm version
11.6.0
Which area(s) of pnpm are affected? (leave empty if unsure)
CLI
Link to the code that reproduces this issue or a replay of the bug
pnpm setup
Reproduction steps
Just run this command
pnpm setupDescribe the Bug
Why does pnpm require allowing builds for its own build? Because
pnpm self-updatedidn’t ask for it. Onlypnpm setupasks. It seems suspicious.Expected Behavior
Even if pnpm has its own build step, it must not ask for permission. It feels like someone has pushed postinstall script malware to pnpm.
Which Node.js version are you using?
24.15.0
Which operating systems have you used?
If your OS is a Linux based, which one it is? (Include the version if relevant)
No response