Enforce minimumReleaseAge before download/linking

[tw-blue]

My company would like to switch from npm to pnpm but there is currently the security concern that even with minimumReleaseAge set, pnpm will download potentially vulnerable packages and link them in the node_modules folder.
If any package were to contain a malicious executable, it would of course not be executed but still having downloaded it in the first place seems awkward.

It looks like the supply-chain policy check currently happens in parallel to already downloading the packages.

Our proposal would be (maybe behind a switch in pnpm-workspace.yaml) to first check the supply-chain rules and aborting the install before starting to download new packages.

If we are missing some other way to mitigate this problem i would also be very thankful for any hints

[DustdevDM]

yeah this is a security concern for us too. Potentially vulnerable packages should not be downloaded, which is currently done. Is there any command flag to change this behaviour?