enhance: vp pm audit — supply chain signals beyond CVE databases

[ranjithrajv]

Description

vp pm audit and vp pm audit --fix already pass through to the underlying package manager, covering known CVEs and automated fixes. The remaining gap is supply chain signals that CVE databases don't catch:

• Unexpected publish authors (first-time push from an account that never touched the package)
• New post-install scripts that weren't present in the prior version
• Version bumps with no changelog entry

These signals preceded several major incidents in 2025 — including the axios compromise on March 31st — and none of them would have been caught by a standard audit passthrough.

Suggested enhancement

Layer supply chain signal checks on top of the existing vp pm audit passthrough, backed by OSV/GitHub Advisory for CVEs plus registry metadata for behavioral signals:

• Flag packages where a new publisher account made the latest release
• Flag new or modified postinstall/preinstall scripts since the last installed version
• Warn on version bumps with no changelog when a changelog previously existed
• Optional auto-run on vp dev/vp build behind a config flag
• Output consistent with Vite+'s existing diagnostic style

Additional context

• Microsoft Security Blog — Mitigating the Axios npm supply chain compromise
• Infosecurity Magazine — Five Key Flaws Exploited in 2025's Software Supply Chain Incidents
• Palo Alto Networks — Widespread npm Supply Chain Attack Puts Billions of Weekly Downloads at Risk

[fengmk2]

you can use vp pm audit, it will pass to the real pm audit command.

[ranjithrajv]

Thanks @fengmk2 — good to know! I've updated the issue to reflect that vp pm audit and vp pm audit --fix already cover CVE checking and fixes via passthrough. The ask is now focused on layering supply chain signal detection on top (unexpected publish authors, new install scripts, changelog-less bumps) — things the passthrough alone can't catch.

[cpojer]

At this time, we are not taking on work on enhancing the underlying package manager. Your feature request is best forwarded to pnpm. We may reconsider this in the future.