跳到主要内容
知知仓学习社ZHICANG

pnpm

Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, …

读凭据写文件严重 25 · 高危 10antfu/skills

它会碰到什么

扫了多少18 个文本文件，83 KB
它会碰到什么读凭据写文件
命中总数37 处
命中统计严重 25 · 高 10 · 中 0 · 低 0
逐条看命中（30 条严重或高危）
  • 严重 references/best-practices-migration.md:22cred-paths
    - **Splits `.npmrc`**: only auth/registry settings stay in `.npmrc`; every other key moves to `pnpm-workspace.yaml` as **camelCase** (e.g. `node-linker` → `node
  • 严重 references/best-practices-migration.md:22cred-paths
    - **Splits `.npmrc`**: only auth/registry settings stay in `.npmrc`; every other key moves to `pnpm-workspace.yaml` as **camelCase** (e.g. `node-linker` → `node
  • 严重 references/best-practices-migration.md:22cred-paths
    - **Splits `.npmrc`**: only auth/registry settings stay in `.npmrc`; every other key moves to `pnpm-workspace.yaml` as **camelCase** (e.g. `node-linker` → `node
  • 严重 references/best-practices-migration.md:226cred-paths
    Keep only **auth/registry** in `.npmrc`; put everything else in `pnpm-workspace.yaml` (camelCase).
  • 严重 references/best-practices-migration.md:228cred-paths
    ```ini title=".npmrc (auth only, gitignored)"
  • 严重 references/core-config.md:3cred-paths
    description: Configuring pnpm via pnpm-workspace.yaml (settings), the global config.yaml, and .npmrc (auth only)
  • 严重 references/core-config.md:13cred-paths
    | **Auth & registry credentials** (`_authToken`, `cert`, `key`, …) | `.npmrc` (project, gitignored) and global `rc` | INI |
  • 严重 references/core-config.md:15cred-paths
    > **Important changes:** pnpm no longer reads settings from the `pnpm` field of `package.json`, and `.npmrc` is now used **only** for authentication/registry cr
  • 严重 references/core-config.md:15cred-paths
    > **Important changes:** pnpm no longer reads settings from the `pnpm` field of `package.json`, and `.npmrc` is now used **only** for authentication/registry cr
  • 严重 references/core-config.md:78cred-paths
    There are no per-subproject `.npmrc` files anymore. Set per-package config via `packageConfigs` in the root `pnpm-workspace.yaml`:
  • 严重 references/core-config.md:93cred-paths
    ## .npmrc — authentication only
  • 严重 references/core-config.md:95cred-paths
    Keep auth tokens out of the repo (gitignore the project `.npmrc`). Auth files, highest priority first:
  • 严重 references/core-config.md:97cred-paths
    1. `<workspace root>/.npmrc` (project, gitignored)
  • 严重 references/core-config.md:99cred-paths
    3. `~/.npmrc` (fallback for npm compatibility)
  • 严重 references/core-config.md:101cred-paths
    ```ini title=".npmrc"
  • 严重 references/core-config.md:118cred-paths
    > Security: since v11, env-variable expansion is disabled for registry/proxy URLs and credential keys in the **project** `.npmrc` (to stop a malicious repo from
  • 严重 references/core-config.md:171cred-paths
    - All pnpm settings go in `pnpm-workspace.yaml` (camelCase) or global `config.yaml`; `.npmrc` is auth/registry only.
  • 严重 references/core-store.md:55cred-paths
    Store/linker settings live in `pnpm-workspace.yaml` (camelCase), not `.npmrc`.
  • 严重 references/core-workspaces.md:127cred-paths
    Configure in `pnpm-workspace.yaml` using **camelCase** keys (these settings no longer belong in `.npmrc`):
  • 严重 references/core-workspaces.md:152cred-paths
    There are no per-subproject `.npmrc` files. Set package-specific settings from the root file:
  • 严重 references/core-workspaces.md:194cred-paths
    6. **Keep all pnpm settings in `pnpm-workspace.yaml`** (camelCase), not `.npmrc`
  • 严重 references/features-aliases.md:164cred-paths
    The built-in `gh:` alias points at GitHub Packages. Auth is reused from per-URL `.npmrc` entries.
  • 严重 SKILL.md:12cred-paths
    **Configuration model (important):** pnpm settings now live in `pnpm-workspace.yaml` (and the global `config.yaml`) using **camelCase** keys. `.npmrc` is used *
  • 严重 SKILL.md:12cred-paths
    **Configuration model (important):** pnpm settings now live in `pnpm-workspace.yaml` (and the global `config.yaml`) using **camelCase** keys. `.npmrc` is used *
  • 严重 SKILL.md:21cred-paths
    | Configuration | pnpm-workspace.yaml settings (camelCase), global config.yaml, packageConfigs, .npmrc auth | [core-config](references/core-config.md) |
  • 高 references/features-config-dependencies.md:45identity-config-write
    export const hooks = { readPackage }
  • 高 references/features-config-dependencies.md:53identity-config-write
    export const hooks = {
  • 高 references/features-hooks.md:10identity-config-write
    > The modern format uses ESM `export const hooks = { ... }`. The old CommonJS `module.exports = { hooks }` still works in `.pnpmfile.cjs`.
  • 高 references/features-hooks.md:15identity-config-write
    export const hooks = {
  • 高 references/features-hooks.md:56identity-config-write
    export const hooks = { readPackage }

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, and enforces strict dependency resolution by default, preventing phantom dependencies.

Configuration model (important): pnpm settings now live in pnpm-workspace.yaml (and the global config.yaml) using camelCase keys. .npmrc is used only for authentication/registry credentials, and the pnpm field of package.json is no longer read. When working in a pnpm project, check pnpm-workspace.yaml for settings/workspace structure and .npmrc only for auth. Always use --frozen-lockfile (or pnpm ci) in CI.

> The skill is based on pnpm 10.x, generated at 2026-06-22. It also covers v11 behavior changes (config split, isolated global packages, allowBuilds, pmOnFail, global virtual store) where current docs describe them.

Core

| Topic | Description | Reference |

|-------|-------------|-----------|

| CLI Commands | install/add/remove/update, run, dlx/pnx, workspace, runtime, publishing (version, view, sbom, stage) | [core-cli](references/core-cli.md) |

| Configuration | pnpm-workspace.yaml settings (camelCase), global config.yaml, packageConfigs, .npmrc auth | [core-config](references/core-config.md) |

| Workspaces | Monorepo support: filtering, workspace protocol, shared lockfile, packageConfigs | [core-workspaces](references/core-workspaces.md) |

| Store | Content-addressable store, virtual store, node linker modes, frozen/read-only store | [core-store](references/core-store.md) |

Features

| Topic | Description | Reference |

|-------|-------------|-----------|

| Catalogs | Centralized dependency versions; catalogMode, catalog: in overrides | [features-catalogs](references/features-catalogs.md) |

| Overrides | Force versions (incl. transitive & peer deps); packageExtensions | [features-overrides](references/features-overrides.md) |

| Patches | Modify third-party packages; patchedDependencies in pnpm-workspace.yaml | [features-patches](references/features-patches.md) |

| Aliases | Install under custom names (npm:) and registry aliases (namedRegistries) | [features-aliases](references/features-aliases.md) |

| Hooks | .pnpmfile.mjs hooks (readPackage, updateConfig, beforePacking), finders, resolvers/fetchers | [features-hooks](references/features-hooks.md) |

| Peer Dependencies | Auto-install, strict mode, rules, dedupePeers, peers check | [features-peer-deps](references/features-peer-deps.md) |

| Config Dependencies | Share hooks/settings/catalogs/patches across repos via configDependencies | [features-config-dependencies](references/features-config-dependencies.md) |

| Global Virtual Store | Shared node_modules, git-worktree multi-agent setups, isolated global packages | [features-global-virtual-store](references/features-global-virtual-store.md) |

| Supply-Chain Security | Build approval (allowBuilds), minimumReleaseAge, trustPolicy, lockfile integrity | [features-supply-chain-security](references/features-supply-chain-security.md) |

Best Practices

| Topic | Description | Reference |

|-------|-------------|-----------|

| CI/CD Setup | GitHub Actions, GitLab, Docker, pnpm ci, store caching, frozen lockfiles | [best-practices-ci](references/best-practices-ci.md) |

| Migration | npm/Yarn → pnpm, phantom deps, and pnpm v10 → v11 config migration | [best-practices-migration](references/best-practices-migration.md) |

| Performance | Install optimizations, allowBuilds, global virtual store, workspace parallelization | [best-practices-performance](references/best-practices-performance.md) |

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库antfu/skills
星标★ 5,891
本站分层T1
该仓技能数19
原文件路径skills/pnpm/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 19 个技能