@pnpm/deps.inspection.commands
The list, ll, why, and outdated commands of pnpm
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@zkochan/table | AI (phantom-deps): Known pnpm table renderer dep, false positive. | ai | |
| phantom-deps | phantom-dep:hosted-git-info | AI (phantom-deps): Standard dep aliased via npm:, false positive. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Monorepo shared dep pattern; not evidence of malicious injection. | ai | |
| phantom-deps | phantom-dep:ramda | AI (phantom-deps): Standard util dep, false positive from heuristic import scan. | ai | |
| phantom-deps | phantom-dep:render-help | AI (phantom-deps): Known pnpm CLI helper, false positive. | ai | |
| dependencies | unvetted-dep:@pnpm/deps.github-actions | AI (dependencies): First-party pnpm org package, part of normal monorepo dependency graph. | ai | |
| provenance | no-provenance | AI (provenance): pnpm monorepo packages consistently lack provenance attestation; stable false positive for this org. | ai | |
| dependencies | unvetted-dep:@pnpm/deps.inspection.list | AI (dependencies): Same-org monorepo sibling; coordinated versioning is expected for pnpm packages. | ai | |
| dependencies | unvetted-dep:@pnpm/global.packages | AI (dependencies): Same-org monorepo sibling; coordinated versioning is expected for pnpm packages. | ai | |
| dependencies | unvetted-dep:@pnpm/deps.inspection.peers-checker | AI (dependencies): Same-org monorepo sibling; coordinated versioning is expected for pnpm packages. | ai | |
| phantom-deps | phantom-dep:@pnpm/store.path | AI (phantom-deps): Monorepo internal dep; phantom-dep heuristic unreliable for pnpm's own scoped packages. | ai | |
| phantom-deps | phantom-dep:@pnpm/resolving.default-resolver | AI (phantom-deps): Monorepo internal dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@pnpm/installing.modules-yaml | AI (phantom-deps): Monorepo internal dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@pnpm/config.matcher | AI (phantom-deps): Monorepo internal dep; stable false positive. | ai | |
| phantom-deps | phantom-dep:@pnpm/lockfile.fs | AI (phantom-deps): Same as above — monorepo internal dep, stable false positive. | ai |
Versions (showing 38 of 38)
| Version | Deps | Published |
|---|---|---|
| 1100.7.0 | 33 / 15 | |
| 1100.6.0 | 33 / 15 | |
| 1100.5.7 | 32 / 15 | |
| 1100.5.2 | 32 / 15 | |
| 1100.5.1 | 32 / 15 | |
| 1100.5.0 | 32 / 15 | |
| 1100.4.1 | 32 / 15 | |
| 1100.4.0 | 32 / 15 | |
| 1100.3.7 | 31 / 15 | |
| 1100.3.6 | 31 / 15 | |
| 1100.3.5 | 31 / 15 | |
| 1100.3.4 | 31 / 15 | |
| 1100.3.3 | 31 / 15 | |
| 1100.3.2 | 31 / 15 | |
| 1100.3.1 | 31 / 16 | |
| 1100.3.0 | 31 / 15 | |
| 1100.2.5 | 31 / 15 | |
| 1100.2.4 | 31 / 15 | |
| 1100.2.3 | 31 / 15 | |
| 1100.2.2 | 31 / 15 | |
| 1100.2.1 | 31 / 15 | |
| 1100.2.0 | 31 / 15 | |
| 1100.1.13 | 30 / 14 | |
| 1100.1.12 | 30 / 14 | |
| 1100.1.11 | 30 / 14 | |
| 1100.1.10 | 30 / 14 | |
| 1100.1.9 | 30 / 14 | |
| 1100.1.8 | 29 / 14 | |
| 1100.1.7 | 29 / 14 | |
| 1100.1.6 | 29 / 14 | |
| 1100.1.5 | 29 / 14 | |
| 1100.1.4 | 29 / 14 | |
| 1100.1.3 | 29 / 14 | |
| 1100.1.2 | 29 / 14 | |
| 1100.1.1 | 29 / 14 | |
| 1100.1.0 | 29 / 14 | |
| 1100.0.0 | 27 / 14 | |
| 1000.0.0 | 21 / 13 |
v1100.7.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.6.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.5.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.5.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.5.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.5.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.