跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Pnpm Skill 安全审计

作者说它能做什么（原文）

Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs, patches, overrides, config dependencies, or the global virtual store.

第三方安全检查结论

先别安装或运行

已检查文件
18
发现的风险
6
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 3 项风险
高风险

批量批准会允许所有待处理依赖执行安装脚本

原文依据：3 处
发现了什么

文档提供 `pnpm approve-builds --all`。这会越过逐包审查机制，而依赖生命周期脚本可以用运行 pnpm 的用户或 CI 身份执行任意代码。

为什么需要注意

恶意或被入侵的依赖可能读取工作区文件和 CI 环境变量、修改构建产物，或使用当前任务可访问的凭据。

这是文档中的主动命令，不只是警告。默认机制会阻止未审查的依赖构建脚本，但 `pnpm approve-builds --all` 会一次批准全部待处理脚本。若代理在未逐包核查时运行它，获批依赖的安装脚本将以当前用户或 CI 权限执行。用户可要求逐包列出并审查脚本，禁止使用 `--all`，并在低权限、无凭据的环境中安装。

references/features-supply-chain-security.md:28来自说明文档打开原文件
### Approving builds```bashpnpm approve-builds            # interactive promptpnpm approve-builds --all      # approve all pendingpnpm approve-builds esbuild fsevents !core-js   # ! = denypnpm add --allow-build=esbuild my-bundler       # approve while addingpnpm add -g --allow-build=esbuild esbuild       # global (replaces approve-builds -g)```
查看另外 2 个位置
references/features-supply-chain-security.md:12来自说明文档打开原文件
By default pnpm does **not** run dependency lifecycle scripts (`preinstall`/`install`/`postinstall`). Packages must be explicitly approved. Approval lives in one `allowBuilds` map in `pnpm-workspace.yaml`.
references/features-supply-chain-security.md:30来自说明文档打开原文件
```bashpnpm approve-builds            # interactive promptpnpm approve-builds --all      # approve all pendingpnpm approve-builds esbuild fsevents !core-js   # ! = denypnpm add --allow-build=esbuild my-bundler       # approve while addingpnpm add -g --allow-build=esbuild esbuild       # global (replaces approve-builds -g)```
高风险

迁移与 CI 示例会取得并运行未固定版本的远程工具

原文依据：3 处
发现了什么

迁移流程直接运行未注明版本或完整性的 `pnpx codemod`，GitLab 示例还激活 `pnpm@latest`。解析到的代码会随注册表当时的内容变化，并在开发机或 CI 中执行。

为什么需要注意

若包名被抢注、发布账户被入侵或 latest 指向有问题的版本，远程代码会获得当前进程的文件和环境权限；CI 中可能同时暴露发布或部署凭据。

两处都是可执行示例。迁移命令通过 `pnpx` 获取并运行未固定版本的 codemod；GitLab 示例明确激活 `pnpm@latest`。因此实际执行内容会随注册表解析结果变化，并继承开发机或 CI 权限。用途与 pnpm 迁移/配置一致，不表明恶意，但用户可要求固定精确版本和完整性、审查锁定产物，并限制 CI 凭据与网络权限。

references/best-practices-migration.md:12来自说明文档打开原文件
v11 changes how configuration is read. Most of it is mechanical — run the codemod:```bashcd /path/to/projectpnpx codemod run pnpm-v10-to-v11```
查看另外 2 个位置
references/features-catalogs.md:160来自说明文档打开原文件
Then update package.json files to use `catalog:`. To migrate an existing workspace automatically:```bashpnpx codemod pnpm/catalog```
references/best-practices-ci.md:105来自说明文档打开原文件
before_script:  - corepack enable  - corepack prepare pnpm@latest --activatecache:
高风险

配置依赖可在普通依赖之前自动加载 JavaScript 钩子

原文依据：5 处
发现了什么

配置依赖先于普通依赖安装，特定命名的包会自动加载 pnpmfile。钩子可以改依赖清单、锁文件、设置、包链接方式和发布清单；`--ignore-scripts` 也不会禁用它。

为什么需要注意

未经审查的配置包可改变实际安装或发布的内容、重定向包获取、执行其钩子逻辑，导致供应链代码执行或生成与用户预期不同的制品。

配置依赖是明确的主动扩展机制：它们先于普通依赖安装，符合命名规则的包会自动加载 `pnpmfile`。这些钩子能改依赖清单、锁文件、pnpm 设置、链接过程和发布清单，而且 `--ignore-scripts` 不会关闭它们。因此，添加不可信配置依赖可能改变安装或发布决策。用户可要求固定并审查配置依赖及其 pnpmfile，禁止未经批准新增，并启用 `ignorePnpmfile` 隔离不可信项目。

references/features-config-dependencies.md:8来自说明文档打开原文件
Config dependencies are npm packages that pnpm installs **before** all regular dependencies, so they can supply hooks, settings, patches, catalogs, and overrides that are reused across many repositories. They let you keep one shared "pnpm config" package and consume it everywhere.## Declaring config dependenciesThey live in `pnpm-workspace.yaml`; their integrity is recorded in a dedicated env-lockfile document inside `pnpm-lock.yaml`.
查看另外 4 个位置
references/features-config-dependencies.md:32来自说明文档打开原文件
## Auto-loaded pluginsA config dependency named `pnpm-plugin-*`, `@*/pnpm-plugin-*`, or `@pnpm/plugin-*` has its `pnpmfile.mjs` (or `.cjs`) loaded automatically from the package root.
references/features-hooks.md:25来自说明文档打开原文件
| Hook | When | Use ||------|------|-----|| `readPackage(pkg, ctx)` | after a dependency manifest is parsed | mutate a dependency's `package.json` (affects resolution) || `afterAllResolved(lockfile, ctx)` | after resolution | mutate the lockfile before it's written || `updateConfig(config)` | before install | mutate pnpm's settings (great with config dependencies) || `beforePacking(pkg)` | before `pnpm pack`/`publish` tarball | customize the **published** manifest only || `preResolution(opts)` | after reading lockfiles, before resolution | inspect/modify lockfile objects || `importPackage(dir, opts)` | when writing to node_modules | change how packages are linked |
references/features-hooks.md:168来自说明文档打开原文件
## Key Points- Prefer `.pnpmfile.mjs` with `export const hooks`/`finders`/`resolvers`/`fetchers`.- New hooks: `updateConfig` (mutate settings), `beforePacking` (published manifest), `preResolution`, `importPackage`.- Pair `updateConfig` with config dependencies to share settings/catalogs across repos.- `--ignore-scripts` does **not** disable the pnpmfile; use `ignorePnpmfile`.
references/features-hooks.md:173来自说明文档打开原文件
- Pair `updateConfig` with config dependencies to share settings/catalogs across repos.- `--ignore-scripts` does **not** disable the pnpmfile; use `ignorePnpmfile`.
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 1 项风险
中风险

迁移和回滚命令会递归删除依赖目录及锁定配置

原文依据：3 处
发现了什么

多个流程先执行 `rm -rf`，删除 node_modules、旧锁文件，回滚还删除 pnpm 锁文件和工作区配置。部分命令使用 `packages/*/node_modules`，作用于整个单仓库。

为什么需要注意

未提交的配置或手工修改会丢失；删除旧锁文件后重新解析依赖可能得到不同版本，使构建不可复现。路径或当前目录判断错误还会扩大删除范围。

这些是迁移、重装和回滚章节中的示例，删除旧依赖目录或锁文件与其目的相符，并非隐藏行为；但命令确实会立即递归删除文件。单仓库示例覆盖所有匹配的包，回滚还删除 `pnpm-workspace.yaml`，可能丢失未提交配置或破坏可复现性。用户可要求执行前确认仓库根目录、检查未提交文件并保留锁文件/配置备份。

references/best-practices-migration.md:41来自说明文档打开原文件
### From npm```bash# Remove npm lockfile and node_modulesrm -rf node_modules package-lock.json# Install with pnpmpnpm install```
查看另外 2 个位置
references/best-practices-migration.md:161来自说明文档打开原文件
3. Install:   ```bash   rm -rf node_modules packages/*/node_modules package-lock.json   pnpm install   ```
references/best-practices-migration.md:291来自说明文档打开原文件
## Rollback PlanIf migration causes issues:```bash# Remove pnpm filesrm -rf node_modules pnpm-lock.yaml pnpm-workspace.yaml# Restore npmnpm install# Or restore Yarnyarn install```
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 1 项风险
中风险

共享可写虚拟存储会把不同项目或代理置于同一信任边界

原文依据：3 处
发现了什么

推荐的全局虚拟存储让多个工作树通过符号链接使用同一可写目录。文档承认它只适用于互信项目、用户和任务，但同时将其推荐给并行 AI 代理。

为什么需要注意

若低信任任务能写该存储，而高信任任务随后复用它，前者可能影响后者加载的包内容或构建输出；影响可跨项目持续存在。

启用后，各项目会通过符号链接使用同一全局虚拟存储。文档明确承认该目录是共享可写状态，只适用于互信项目、用户或任务；多代理工作树示例也假定同一信任边界。若任一项目或代理不可信，共享存储可能让受信任务使用其可写内容。用户可将不同信任级别分配到独立存储和系统账户、限制目录权限，或不启用此实验选项。

references/features-global-virtual-store.md:25来自说明文档打开原文件
- **Package identity = hash of the dependency graph.** Two projects with the same `lodash@4.17.21` and the same transitive tree point at the exact same directory (NixOS-style). Different peers ⇒ separate entries.- **Near-zero per-project cost** and **instant installs** once a version is in the store.- In **pnpm v11** it is the default for `pnpm dlx`/`pnx` and global installs; for **project** installs it is still **opt-in/experimental**.### Limitations- **CI:** auto-disabled (no warm cache to benefit from).- **Trust:** the store is shared writable state — only for mutually trusting projects/users/jobs; protect the path with filesystem permissions.- **ESM hoisting:** relies on `NODE_PATH`, which Node ignores for ESM imports. If ESM deps import undeclared packages, resolution fails. Fix with `packageExtensions` or the `@pnpm/plugin-esm-node-path` config dependency.
查看另外 2 个位置
references/features-global-virtual-store.md:35来自说明文档打开原文件
## Git worktrees for multi-agent developmentGit worktrees let you check out many branches simultaneously, each in its own directory, sharing one `.git` object store. Combined with the global virtual store, every worktree gets a fully functional `node_modules` that is almost free on disk — ideal for running multiple AI agents in parallel.
references/features-global-virtual-store.md:59来自说明文档打开原文件
Each worktree has its own `node_modules` tree (so agents can install different versions on different branches without conflict), but all package contents come from the one shared store. Remove a worktree with `git worktree remove ./feature-auth`.> The pnpm repo itself uses this setup and ships helper scripts (`pnpm worktree:new <branch|pr>`). Assumes all worktrees/agents share the same trust boundary.
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 1 项风险
中风险

发布参考包含跳过 Git 检查及改变公开包状态的命令

原文依据：2 处
发现了什么

命令表列出递归发布并关闭 Git 检查，以及弃用、修改 dist-tag 和撤回版本。这些操作使用当前注册表身份，可能立即影响所有消费者。

为什么需要注意

错误的包、版本或作用域可能被发布、弃用、重新标记或撤回，造成供应链中断、错误版本分发和声誉或收入损失。

发布章节列出的都是可执行的注册表操作，而非仅描述概念。`publish -r --no-git-checks` 可递归发布并绕过 pnpm 的 Git 状态检查；`deprecate`、`dist-tag` 和 `unpublish` 会改变公开包元数据或可用性。它们符合包管理器参考用途，但若代理误用当前登录身份，可能影响消费者。用户可要求发布前逐包确认、保留 Git 检查、使用最小权限令牌，并为撤回或标签变更设置人工审批。

references/core-cli.md:143来自说明文档打开原文件
## Publishing```bashpnpm packpnpm publish -r --no-git-checkspnpm version patch|minor|major|2.0.0    # bump version, commit + tag (v11)pnpm version prerelease --preid betapnpm deprecate <pkg>@<range> "message"pnpm dist-tag add <pkg>@<version> <tag>pnpm unpublish <pkg>@<version>          # discouraged; prefer deprecatepnpm sbom --sbom-format cyclonedx       # SBOM: cyclonedx (1.7) | spdx (2.3)pnpm stage publish ...                  # staged publishing (defer 2FA)```
查看另外 1 个位置
references/core-workspaces.md:182来自说明文档打开原文件
Use `--no-git-checks` for publishing from CI:```bashpnpm publish -r --no-git-checks```

Skill 逻辑拆解

3 个说明模块

这是一个面向 pnpm 10/11 的参考型 Skill，覆盖依赖安装、工作区、配置、补丁、钩子、共享存储、CI 和发布；主文件把这些操作分流到各参考文档。

查看原文
SKILL.md:20来自说明文档打开原文件
|-------|-------------|-----------|| CLI Commands | install/add/remove/update, run, dlx/pnx, workspace, runtime, publishing (version, view, sbom, stage) | [core-cli](references/core-cli.md) || Configuration | pnpm-workspace.yaml settings (camelCase), global config.yaml, packageConfigs, .npmrc auth | [core-config](references/core-config.md) || Workspaces | Monorepo support: filtering, workspace protocol, shared lockfile, packageConfigs | [core-workspaces](references/core-workspaces.md) || Store | Content-addressable store, virtual store, node linker modes, frozen/read-only store | [core-store](references/core-store.md) |
SKILL.md:31来自说明文档打开原文件
| Overrides | Force versions (incl. transitive & peer deps); packageExtensions | [features-overrides](references/features-overrides.md) || Patches | Modify third-party packages; patchedDependencies in pnpm-workspace.yaml | [features-patches](references/features-patches.md) || Aliases | Install under custom names (npm:) and registry aliases (namedRegistries) | [features-aliases](references/features-aliases.md) || Hooks | .pnpmfile.mjs hooks (readPackage, updateConfig, beforePacking), finders, resolvers/fetchers | [features-hooks](references/features-hooks.md) || Peer Dependencies | Auto-install, strict mode, rules, dedupePeers, peers check | [features-peer-deps](references/features-peer-deps.md) || Config Dependencies | Share hooks/settings/catalogs/patches across repos via configDependencies | [features-config-dependencies](references/features-config-dependencies.md) || Global Virtual Store | Shared node_modules, git-worktree multi-agent setups, isolated global packages | [features-global-virtual-store](references/features-global-virtual-store.md) || Supply-Chain Security | Build approval (allowBuilds), minimumReleaseAge, trustPolicy, lockfile integrity | [features-supply-chain-security](references/features-supply-chain-security.md) |

Skill 指示把项目级 pnpm 设置放入 pnpm-workspace.yaml，并把含凭据的 .npmrc 排除出版本控制；这会让代理在处理配置时接触认证文件，但文本没有要求读取或传输令牌值。

查看原文
SKILL.md:12来自说明文档打开原文件
**Configuration model (important):** pnpm settings now live in `pnpm-workspace.yaml` (and the global `config.yaml`) using **camelCase** keys. `.npmrc` is used **only** for authentication/registry credentials, and the `pnpm` field of `package.json` is no longer read. When working in a pnpm project, check `pnpm-workspace.yaml` for settings/workspace structure and `.npmrc` only for auth. Always use `--frozen-lockfile` (or `pnpm ci`) in CI.
references/core-config.md:93来自说明文档打开原文件
## .npmrc — authentication onlyKeep auth tokens out of the repo (gitignore the project `.npmrc`). Auth files, highest priority first:1. `<workspace root>/.npmrc` (project, gitignored)2. `<pnpm config>/auth.ini` (written by `pnpm login`)3. `~/.npmrc` (fallback for npm compatibility)

文档说明 pnpm 的安全默认值，包括阻止未批准的依赖构建脚本、锁文件完整性失败以及仅在互信任务间共享缓存。这些是保护声明，实际效果仍取决于所安装的 pnpm 版本和项目配置。

查看原文
references/features-supply-chain-security.md:12来自说明文档打开原文件
By default pnpm does **not** run dependency lifecycle scripts (`preinstall`/`install`/`postinstall`). Packages must be explicitly approved. Approval lives in one `allowBuilds` map in `pnpm-workspace.yaml`.```yaml title="pnpm-workspace.yaml"allowBuilds:  esbuild: true  core-js: false  # version selectors are supported  nx@21.6.4 || 21.6.5: true```- Packages **not listed** are unreviewed and blocked by default.- `strictDepBuilds: true` (default) ⇒ unreviewed builds make install exit non-zero (`ERR_PNPM_IGNORED_BUILDS`). Set `false` to warn instead.- During install, unreviewed packages with build scripts are auto-added to `pnpm-workspace.yaml` with a placeholder so you can set `true`/`false`.
references/features-supply-chain-security.md:78来自说明文档打开原文件
## Lockfile integritySince v11, a downloaded tarball whose hash doesn't match `pnpm-lock.yaml` is a hard error (`ERR_PNPM_TARBALL_INTEGRITY`) — protecting committed lockfiles from a compromised registry/proxy. `--force` and `pnpm update` do **not** bypass it.```bashpnpm install --update-checksums   # narrow opt-in after verifying the new bytes```
references/best-practices-ci.md:68来自说明文档打开原文件
> **Trust:** only cache/restore the pnpm store and cache dir between *trusted* jobs. A store an untrusted job can write to must not be reused by trusted jobs — it is part of pnpm's trust domain.
从这里开始 · 工作说明SKILL.md
pnpm
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

16 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录18 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/best-practices-ci.md已纳入全文
  • references/best-practices-migration.md已纳入全文
  • references/best-practices-performance.md已纳入全文
  • references/core-cli.md已纳入全文
  • references/core-config.md已纳入全文
  • references/core-store.md已纳入全文
  • references/core-workspaces.md已纳入全文
  • references/features-aliases.md已纳入全文
  • references/features-catalogs.md已纳入全文
  • references/features-config-dependencies.md已纳入全文
  • references/features-global-virtual-store.md已纳入全文
  • references/features-hooks.md已纳入全文
  • references/features-overrides.md已纳入全文
  • references/features-patches.md已纳入全文
  • references/features-peer-deps.md已纳入全文
  • references/features-supply-chain-security.md已纳入全文
  • GENERATION.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • GENERATION.md配套文件
  • SKILL.md工作说明
  • references/best-practices-ci.md配套文件
  • references/best-practices-migration.md配套文件
  • references/best-practices-performance.md配套文件
  • references/core-cli.md配套文件
  • references/core-config.md配套文件
  • references/core-store.md配套文件
  • references/core-workspaces.md配套文件
  • references/features-aliases.md配套文件
  • references/features-catalogs.md配套文件
  • references/features-config-dependencies.md配套文件
  • references/features-global-virtual-store.md配套文件
  • references/features-hooks.md配套文件
  • references/features-overrides.md配套文件
  • references/features-patches.md配套文件
  • references/features-peer-deps.md配套文件
  • references/features-supply-chain-security.md配套文件

代码和说明中提到的操作

连接外部网站
SKILL.md:7来自说明文档打开原文件
  version: "2026.6.22"  source: Generated from https://github.com/pnpm/pnpm, scripts located at https://github.com/antfu/skills---
references/best-practices-ci.md:293来自说明文档打开原文件
Source references:- https://pnpm.io/continuous-integration- https://pnpm.io/docker
references/best-practices-ci.md:294来自说明文档打开原文件
- https://pnpm.io/continuous-integration- https://pnpm.io/docker- https://pnpm.io/cli/ci
读取密钥或账号配置
SKILL.md:12来自说明文档打开原文件
**Configuration model (important):** pnpm settings now live in `pnpm-workspace.yaml` (and the global `config.yaml`) using **camelCase** keys. `.npmrc` is used **only** for authentication/registry credentials, and the `pnpm` field of `package.json` is no longer read. When working in a pnpm project, check `pnpm-workspace.yaml` for settings/workspace structure and `.npmrc` only for auth. Always use `--frozen-lockfile` (or `pnpm ci`) in CI.
references/core-config.md:13来自说明文档打开原文件
| **All pnpm/install settings** (`nodeLinker`, `hoistPattern`, `autoInstallPeers`, `overrides`, `catalog`, …) | `pnpm-workspace.yaml` (project) and `config.yaml` (global) | YAML, **camelCase** keys || **Auth & registry credentials** (`_authToken`, `cert`, `key`, …) | `.npmrc` (project, gitignored) and global `rc` | INI |
references/core-config.md:15来自说明文档打开原文件
> **Important changes:** pnpm no longer reads settings from the `pnpm` field of `package.json`, and `.npmrc` is now used **only** for authentication/registry credentials. Everything else belongs in `pnpm-workspace.yaml`. Keys in YAML are **camelCase** (e.g. `nodeLinker`), not the kebab-case used by old `.npmrc` files.
安装其他软件包
references/best-practices-ci.md:36来自说明文档打开原文件
      - run: pnpm install --frozen-lockfile   # or: pnpm ci      - run: pnpm test
references/best-practices-ci.md:41来自说明文档打开原文件
> `pnpm ci` (aliases `clean-install`, `install-clean`) = `pnpm clean` + `pnpm install --frozen-lockfile`, ideal for fully reproducible CI builds.
references/best-practices-ci.md:65来自说明文档打开原文件
- run: pnpm install --frozen-lockfile```
运行命令
references/best-practices-ci.md:53来自说明文档打开原文件
- name: Get pnpm store directory  shell: bash  run: |
references/best-practices-ci.md:203来自说明文档打开原文件
```bashpnpm install --frozen-lockfile
references/best-practices-ci.md:211来自说明文档打开原文件
```bashpnpm install --frozen-lockfile --prefer-offline
修改文件
references/best-practices-migration.md:45来自说明文档打开原文件
# Remove npm lockfile and node_modulesrm -rf node_modules package-lock.json
references/best-practices-migration.md:55来自说明文档打开原文件
# Remove yarn lockfile and node_modulesrm -rf node_modules yarn.lock
references/best-practices-migration.md:138来自说明文档打开原文件
# Or reinstallrm -rf node_modulespnpm install
读取文件
references/features-hooks.md:31来自说明文档打开原文件
| `beforePacking(pkg)` | before `pnpm pack`/`publish` tarball | customize the **published** manifest only || `preResolution(opts)` | after reading lockfiles, before resolution | inspect/modify lockfile objects || `importPackage(dir, opts)` | when writing to node_modules | change how packages are linked |
读取了多少行
3,152
文件校验值（用于核对版本）
4833fcad7a1fc18ab7a5aa123d0ce11b1a31101352c5dde5274d227e6ca956b4