@pnpm/installing.commands
Commands for installation
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@pnpm/deps.github-actions | AI (dependencies): First-party pnpm org package added within its own monorepo. | ai | |
| phantom-deps | phantom-dep:detect-libc | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:render-help | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:@yarnpkg/core | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:@zkochan/table | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:load-json-file | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:normalize-path | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:@zkochan/rimraf | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:@inquirer/prompts | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:@yarnpkg/lockfile | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Monorepo transitive re-export pattern; false positive typical of pnpm packages. | ai | |
| phantom-deps | phantom-dep:ramda | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:ci-info | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:p-limit | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:p-filter | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| phantom-deps | phantom-dep:is-subdir | AI (phantom-deps): Same false-positive pattern across pnpm monorepo deps. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): detect-libc is a well-known, benign utility; addition is consistent with native binary support in pnpm. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): pnpm intentionally passes process.env to child processes; this is a core package manager pattern, not exfiltration. | ai | |
| phantom-deps | phantom-dep:@pnpm/fs.read-modules-dir | AI (phantom-deps): Same-org scoped package; monorepo internal dependency pattern. | ai | |
| phantom-deps | phantom-dep:@pnpm/pkg-manifest.reader | AI (phantom-deps): Same-org scoped package; monorepo internal dependency pattern. | ai | |
| phantom-deps | phantom-dep:@pnpm/workspace.root-finder | AI (phantom-deps): Same-org scoped package; monorepo internal dependency pattern. | ai | |
| phantom-deps | phantom-dep:@pnpm/config.pick-registry-for-package | AI (phantom-deps): Same-org scoped package; monorepo internal dependency pattern. | ai | |
| phantom-deps | phantom-dep:@pnpm/catalogs.types | AI (phantom-deps): Same-org scoped package; monorepo internal dependency pattern. | ai | |
| phantom-deps | phantom-dep:get-npm-tarball-url | AI (phantom-deps): Config-file reference in pnpm monorepo; stable pattern. | ai | |
| phantom-deps | phantom-dep:version-selector-type | AI (phantom-deps): Config-file reference in pnpm monorepo; stable pattern. | ai |
Versions (showing 41 of 41)
| Version | Deps | Published |
|---|---|---|
| 1100.12.0 | 72 / 30 | |
| 1100.11.0 | 72 / 30 | |
| 1100.10.9 | 69 / 30 | |
| 1100.10.6 | 69 / 30 | |
| 1100.10.5 | 68 / 30 | |
| 1100.10.4 | 68 / 30 | |
| 1100.10.3 | 68 / 30 | |
| 1100.10.2 | 68 / 30 | |
| 1100.10.1 | 68 / 30 | |
| 1100.10.0 | 68 / 30 | |
| 1100.9.0 | 66 / 29 | |
| 1100.8.0 | 65 / 29 | |
| 1100.7.3 | 65 / 29 | |
| 1100.7.2 | 60 / 29 | |
| 1100.7.1 | 60 / 29 | |
| 1100.7.0 | 60 / 29 | |
| 1100.6.0 | 60 / 30 | |
| 1100.5.0 | 60 / 29 | |
| 1100.4.2 | 60 / 29 | |
| 1100.4.1 | 60 / 29 | |
| 1100.4.0 | 60 / 29 | |
| 1100.3.0 | 60 / 29 | |
| 1100.2.2 | 58 / 30 | |
| 1100.2.1 | 58 / 30 | |
| 1100.2.0 | 58 / 30 | |
| 1100.1.12 | 58 / 30 | |
| 1100.1.11 | 58 / 30 | |
| 1100.1.10 | 58 / 30 | |
| 1100.1.9 | 58 / 30 | |
| 1100.1.8 | 58 / 30 | |
| 1100.1.7 | 58 / 30 | |
| 1100.1.6 | 58 / 30 | |
| 1100.1.5 | 58 / 30 | |
| 1100.1.4 | 58 / 30 | |
| 1100.1.3 | 58 / 30 | |
| 1100.1.2 | 59 / 31 | |
| 1100.1.1 | 59 / 31 | |
| 1100.1.0 | 59 / 31 | |
| 1100.0.1 | 59 / 31 | |
| 1100.0.0 | 59 / 31 | |
| 1004.6.10 | 58 / 30 |
v1100.12.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.11.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v1100.10.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.