code.pnpm-auditpnpm audit
Runs `pnpm audit --json --config.ignore-pnpmfile=true --config.manage-package-manager-versions=false` per lockfile (pnpm-lock.yaml). Runs on a temporary copy of the lockfile and package.json, so nothing is installed, no script runs and the project's .npmrc/bunfig/workspace config is never read. The registry is pinned to registry.npmjs.org; private registries are therefore not audited.
- Engine
- Wrapped scanner
- Wraps
pnpm- Targets
- Codebase
- Areas
- Supply chain, Security
- Runs
- By default, when the target applies
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit . --only code.pnpm-auditWraps pnpm. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.