- Fixed a security issue (GHSA) by disabling ${ENV_VAR} expansion in project/workspace .npmrc files to stop leaking secrets to malicious registries.
- Blocked repository‑controlled .npmrc from overriding user/global config paths (userconfig, globalconfig, prefix), closing a bypass.
- Added clearer warnings, upgraded @pnpm/npm-conf to 3.0.3, and provided migration steps for moving auth tokens to a trusted user‑level .npmrc.