Description

Cat (Denperidge)

opened on Dec 28, 2025

Issue body actions

Hiya! There is (at least from my socket-inexperienced perspective) an inconsistency from the safe npm FAQ and this project's README.

The FAQ (chapter "How is the wrapper implemented?") says safe npm only currently works with npm, whilst the README mentions wrapping pnpm and yarn with security features

Does the latter refer to non-install security features? Or is the FAQ behind on this documentarion?

Activity

1. John-David Dalton (jdalton)

   added 6 commits that reference this issue on Jul 24, 2026

   docs(readme): clarify install-time protection covers npm, pnpm, and yarn

   a261a25

   docs(readme): clarify install-time protection covers npm, pnpm, and yarn

   e934e79

   docs(readme): clarify install-time protection covers npm, pnpm, and yarn

   710c2b5

   docs(readme): clarify install-time protection covers npm, pnpm, and yarn

   8206ed3

   docs(readme): clarify install-time protection covers npm, pnpm, and y…

   4b65820

   docs(readme): clarify install-time protection covers npm, pnpm, and yarn

   21a3034
2. John-David Dalton (jdalton)

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   on Jul 27, 2026
3. jdalton commented on Aug 5, 2026

   

   John-David Dalton (jdalton)

   on Aug 5, 2026

   Contributor

   More actions

   The README is right and the FAQ is behind. socket pnpm and socket yarn are real commands that wrap their package manager the same way socket npm does, and they run the same install-time alert lookup — the shadow layer under src/shadow/pnpm and src/shadow/yarn goes through the same getAlertsMapFromPurls path socket npm uses, so it is install scanning and not just non-install features. The safe npm FAQ page lives on the docs site rather than in this repo, so correcting the "npm only" wording there is a separate change; thanks for flagging the mismatch.

   Reacted by Cat

Issue actions