@pnpm/lockfile.types

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating a package-ownership transparency concern. However, the package is under the same organization namespace and is plausibly a monorepo subpackage, which partly offsets the mismatch.

Workflow auditcaution

All 26 workflows were analyzed with no untrusted checkout or script-injection findings, and all 234 action references are pinned. A high-confidence low-severity finding notes that the release workflow installs a package outside a lockfile, so workflow hygiene is slightly weaker.