Single-Dependency On-Demand Audit

• I'd be willing to implement this feature (contributing guide)

Describe the user story

pnpm audit works well for auditing project dependencies. The need exists to audit a single package. This could be useful when determining to install a package or not, or to avoid problematic versions.

As far as I know, this is not available in any auditing tool or package manager.

Describe the solution you'd like

To make use of the existing audit code as simply as possible;

• pnpm audit <dependency[@version]> [options]
• pnpm would create a temp directory
• init a basic package.json and install the dependency[@version]
• pnpm would then run pnpm audit on that temp directory
• report generated; either pipe stdout/stderr from the child pnpm audit process to the main process, or capture output and direct it to the main process
• clean up the temp directory

Describe the drawbacks of your solution

At first draft of the idea, it will require access to a temp directory. This could be an issue on different cloud providers.

Describe alternatives you've considered

snyk exists, but is not ecosystem native and has it's own critics. It's also limited by signup, and doesn't do single-dependency audits without additional scaffolding. Github Dependabot exists but doesn't address individual versions of packages and doesn't drill-down for monorepos. It's also useless for packages that are on private or alternative source control systems.