跳到主要内容
知仓学习社ZHICANG

pnpm

Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces, or managing dependencies…

读凭据写文件严重 26 · 高危 4JetBrains/skills

它会碰到什么

扫了多少15 个文本文件,54 KB
它会碰到什么读凭据写文件
命中总数32 处
命中统计严重 26 · 高 4 · 中 0 · 低 0
逐条看命中(30 条严重或高危)
  • 严重 references/best-practices-migration.md:69cred-paths
    # .npmrc (default in pnpm v8+)
  • 严重 references/best-practices-migration.md:94cred-paths
    # .npmrc
  • 严重 references/best-practices-migration.md:202cred-paths
    ### .npmrc Settings
  • 严重 references/best-practices-migration.md:204cred-paths
    Most npm/Yarn settings work in pnpm's `.npmrc`:
  • 严重 references/best-practices-performance.md:32cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:59cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:82cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:93cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:126cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:168cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:177cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:187cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:199cred-paths
    # .npmrc
  • 严重 references/best-practices-performance.md:247cred-paths
    Optimized `.npmrc` for performance:
  • 严重 references/core-config.md:3cred-paths
    description: Configuration options via pnpm-workspace.yaml and .npmrc settings
  • 严重 references/core-config.md:8cred-paths
    pnpm uses two main configuration files: `pnpm-workspace.yaml` for workspace and pnpm-specific settings, and `.npmrc` for npm-compatible and pnpm-specific settin
  • 严重 references/core-config.md:40cred-paths
    # pnpm settings (alternative to .npmrc)
  • 严重 references/core-config.md:49cred-paths
    ## .npmrc Settings
  • 严重 references/core-config.md:51cred-paths
    pnpm reads settings from `.npmrc` files. Create at project root or user home.
  • 严重 references/core-config.md:133cred-paths
    2. `~/.npmrc` - User config
  • 严重 references/core-config.md:134cred-paths
    3. `<project>/.npmrc` - Project config
  • 严重 references/core-store.md:59cred-paths
    # .npmrc
  • 严重 references/core-workspaces.md:127cred-paths
    Configure in `.npmrc` or `pnpm-workspace.yaml`:
  • 严重 references/features-peer-deps.md:15cred-paths
    # .npmrc (default is true since pnpm v8)
  • 严重 SKILL.md:13cred-paths
    **Important:** When working with pnpm projects, agents should check for `pnpm-workspace.yaml` and `.npmrc` files to understand workspace structure and configura
  • 严重 SKILL.md:22cred-paths
    | Configuration | pnpm-workspace.yaml, .npmrc settings, and package.json fields | [core-config](references/core-config.md) |
  • references/features-hooks.md:27identity-config-write
    hooks: {
  • references/features-hooks.md:154identity-config-write
    hooks: {
  • references/features-overrides.md:153identity-config-write
    hooks: {
  • references/features-peer-deps.md:125identity-config-write
    hooks: {

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

pnpm is a fast, disk space efficient package manager. It uses a content-addressable store to deduplicate packages across all projects on a machine, saving significant disk space. pnpm enforces strict dependency resolution by default, preventing phantom dependencies. Configuration should preferably be placed in pnpm-workspace.yaml for pnpm-specific settings.

Important: When working with pnpm projects, agents should check for pnpm-workspace.yaml and .npmrc files to understand workspace structure and configuration. Always use --frozen-lockfile in CI environments.

> The skill is based on pnpm 10.x, generated at 2026-01-28.

Core

| Topic | Description | Reference |

|-------|-------------|-----------|

| CLI Commands | Install, add, remove, update, run, exec, dlx, and workspace commands | [core-cli](references/core-cli.md) |

| Configuration | pnpm-workspace.yaml, .npmrc settings, and package.json fields | [core-config](references/core-config.md) |

| Workspaces | Monorepo support with filtering, workspace protocol, and shared lockfile | [core-workspaces](references/core-workspaces.md) |

| Store | Content-addressable storage, hard links, and disk efficiency | [core-store](references/core-store.md) |

Features

| Topic | Description | Reference |

|-------|-------------|-----------|

| Catalogs | Centralized dependency version management for workspaces | [features-catalogs](references/features-catalogs.md) |

| Overrides | Force specific versions of dependencies including transitive | [features-overrides](references/features-overrides.md) |

| Patches | Modify third-party packages with custom fixes | [features-patches](references/features-patches.md) |

| Aliases | Install packages under custom names using npm: protocol | [features-aliases](references/features-aliases.md) |

| Hooks | Customize resolution with .pnpmfile.cjs hooks | [features-hooks](references/features-hooks.md) |

| Peer Dependencies | Auto-install, strict mode, and dependency rules | [features-peer-deps](references/features-peer-deps.md) |

Best Practices

| Topic | Description | Reference |

|-------|-------------|-----------|

| CI/CD Setup | GitHub Actions, GitLab CI, Docker, and caching strategies | [best-practices-ci](references/best-practices-ci.md) |

| Migration | Migrating from npm/Yarn, handling phantom deps, monorepo migration | [best-practices-migration](references/best-practices-migration.md) |

| Performance | Install optimizations, store caching, workspace parallelization | [best-practices-performance](references/best-practices-performance.md) |

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。