npm / yarn / pnpm supply-chain audit Read-only audit of the workspace root. Do not modify any files. 0. Detect package manager If no , stop. Priority: → lockfile → default npm. 1. Tool version Use semver comparison. Verify pinned meets threshold. | Manager | Minimum | |---------|---------| | npm | 11.15.0 | | yarn | 4.14.0 | | pnpm | 11.0.0 | 2. Lifecycle scripts disabled | Manager | PASS | FAIL | |---------|------|------| | npm | has | missing or | | yarn | or key absent | | | pnpm ≥ 11 | unset/ , unset/ , and unset/ | , , or non-empty | | pnpm 10 | OR | neither | pnpm 11+ ignores script set…