Automic Vault

brew package intelligence

pnpm

Automic Vault tracks pnpm because plain text npm auth token matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about pnpm

Fast, disk space efficient package manager

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text npm Auth Token

`pnpm` commonly relies on npm auth tokens stored in ~/.npmrc for private package installs and publishing. Our isotope stores that token in the macOS keychain and injects it as NODE_AUTH_TOKEN only while `pnpm` runs.

Local README excerpt

pnpm Radioisotope

pnpm commonly uses npm auth tokens from ~/.npmrc when installing private packages or publishing packages.

This radioisotope migrates a plaintext npm auth token into the Automic Vault keychain, rewrites .npmrc to reference NODE_AUTH_TOKEN, and wraps pnpm so that token is injected only while pnpm is running.

Caveats

  • We currently support one npm auth token.
  • Existing npm config entries are rewritten to reference NODE_AUTH_TOKEN.
  • This isotope shares the NODE_AUTH_TOKEN key with the Node/npm isotope.

Source: data/radioisotopes/pnpm/README.md

Caveats

  • We currently support one npm auth token.
  • Existing npm config entries are rewritten to reference NODE_AUTH_TOKEN.
  • This isotope shares the NODE_AUTH_TOKEN key with isotope:node.

install metadata

Resolver facts

Package keybrew:pnpm
Last updated2026-05-21T20:40:53Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • local isotope README
  • radioisotope security manifest