@pnpm/config.env-replace

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates a small provenance-transparency concern; the organization-backed pnpm monorepo context partly offsets that concern.

Workflow auditcaution

All 26 workflows were analyzed with no high- or medium-severity findings, no untrusted checkouts, no script injection, and all 234 action references pinned. A high-confidence low-severity adhoc-package finding in the release workflow is a minor hygiene concern.