Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

11.3.0

Which area(s) of pnpm are affected? (leave empty if unsure)

Package manager compatibility

Reproduction steps

1. Create a scoped package with no publishConfig set
2. Run pnpm publish
3. Observe that the package is published as public, when the npm/pnpm 10 default behaviour in this case is that the package should be private

Describe the Bug

Per npm's documentation a scoped package should be private by default.

However, with pnpm 11 publishing a scoped package that has no access config set in publishConfig will result in the package being published as public. And if the package already exists, it will be switched to public along with it's entire version history.

Expected Behavior

Publishing a scoped package should be private by default.

I published the same package with a package.json like the following 3 times, with npm 11, pnpm 10 and pnpm 11. Here are the results:

{
  "name": "@latentflip/package-pnpm-11",
  "version": "1.0.0",
  "description": "",
  "license": "ISC",
  "author": "",
  "type": "commonjs",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "packageManager": "[email protected]"
}

Which Node.js version are you using?

22.22.3

Which operating systems have you used?

• macOS
• Windows
• Linux