--- title: Best Socket posts — May 2026 | daily.dev description: The most upvoted Socket posts from May 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/socketdev/best-of/2026/05 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/socketdev/best-of/2026/05 og:type: website og:site_name: daily.dev og:title: Best Socket posts — May 2026 | daily.dev og:description: The most upvoted Socket posts from May 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Socket — May 2026 1. 1 [](https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu "pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re...") Article Socket · 18w pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re... pnpm 11 ships with new supply chain security defaults: Minimum Release Age is now set to 24 hours (blocking newly published packages for one day), exotic subdependencies are blocked by default, and a new allowBuilds model consolidates build-script execution controls. The release also adds native publishing commands (no longer delegating to npm CLI), built-in SBOM generation (CycloneDX 1.7 / SPDX 2.3), audit fixes via lockfile updates, a SQLite-backed store for faster installs, and isolated global installs. Node.js 22 is now required. Looking ahead, pnpm v12 plans to integrate Pacquet, a Rust-based installation engine, with benchmarks showing install times dropping from 2.3s to under 1 second in warm-cache scenarios. 102 6 2. 2 [](https://daily.dev/posts/popular-go-decimal-library-targeted-by-long-running-typosqua--5muxkobmf "Popular Go Decimal Library Targeted by Long-Running Typosqua...") Article Socket · 16w Popular Go Decimal Library Targeted by Long-Running Typosqua... Socket's Threat Research Team discovered a long-running typosquat of the popular Go library github.com/shopspring/decimal, published as github.com/shopsprint/decimal (swapping 'g' for 't'). The malicious module existed benignly since 2017 before being weaponized in August 2023 with version v1.3.3, which added an init() function that opens a DNS TXT record-based command-and-control channel. The C2 polls a free dynamic DNS subdomain every five minutes and executes any command returned as a TXT record via os/exec.Command. Despite the GitHub repository and owner account being deleted, the malicious release remains permanently cached and fetchable via proxy.golang.org. The attack went undetected for approximately 33 months. Developers are advised to audit go.mod files for the typosquatted path, replace it with the canonical library, and treat any affected build hosts as compromised. Security teams should sinkhole the C2 domain and baseline DNS TXT queries from build infrastructure. 28 3. 3 [](https://daily.dev/posts/fsnotify-maintainer-dispute-sparks-supply-chain-concerns-45fb3ubs9 "fsnotify Maintainer Dispute Sparks Supply Chain Concerns") Article Socket · 18w fsnotify Maintainer Dispute Sparks Supply Chain Concerns A maintainer dispute in fsnotify, a widely used Go filesystem notification library with 321k dependent projects, briefly raised supply chain concerns after contributors were removed from the GitHub organization and recent releases came under scrutiny. Maintainer Martin Tournoij removed access from Yasuhiro Matsumoto (mattn) and others, citing rushed merges, insufficient cross-platform review, and an unauthorized sponsorship file update. Matsumoto had stepped in to help after automated scanners flagged the project as unmaintained due to no release in over a year. No malicious code was found, but the incident highlighted how governance ambiguity in low-level dependencies can trigger downstream verification efforts — with Kubernetes even evaluating potential forks. The episode underscores that unclear maintainer roles and release authority in critical packages can make routine access-control changes indistinguishable from early-stage supply chain attacks. 16 [See all Socket archives](/sources/socketdev/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/socketdev/best-of/2026/05#page","url":"https://daily.dev/sources/socketdev/best-of/2026/05","name":"Best Socket Posts — May 2026","description":"The most upvoted Socket posts from May 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/socketdev/best-of/2026/05#items","numberOfItems":3,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/pnpm-11-adds-supply-chain-protection-defaults-for-minimum-re--wxgk3vhhu","name":"pnpm 11 Adds Supply Chain Protection Defaults for Minimum Re..."},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/popular-go-decimal-library-targeted-by-long-running-typosqua--5muxkobmf","name":"Popular Go Decimal Library Targeted by Long-Running Typosqua..."},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/fsnotify-maintainer-dispute-sparks-supply-chain-concerns-45fb3ubs9","name":"fsnotify Maintainer Dispute Sparks Supply Chain Concerns"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/socketdev/best-of"},{"@type":"ListItem","position":5,"name":"May 2026"}]}]} ```