@pnpm/read-project-manifest
Read a project manifest (called package.json in most cases)
14
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
pnpmuserzkochan
Keywords
pnpmpnpm10
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): zkochan is pnpm's founder and primary maintainer; the prior publisher 'pnpmuser' was a CI/bot account. This transition is a legitimate workflow change, not a takeover. | ai | |
| publish-pattern | dormant-publish | AI (publish-pattern): The 1001.x version series is a new major version line for pnpm10; apparent dormancy reflects the versioning scheme, not account inactivity. zkochan has a long, clean publishing history. | ai | |
| provenance | no-provenance | AI (provenance): pnpm monorepo packages are published by the trusted pnpmuser account without Sigstore provenance; this is consistent across all pnpm packages and not a security concern. | ai |