From 8206ed3ce8ce00ef39facaad185d926c68ac5587 Mon Sep 17 00:00:00 2001 From: jdalton Date: Fri, 24 Jul 2026 14:34:31 -0400 Subject: [PATCH] docs(readme): clarify install-time protection covers npm, pnpm, and yarn MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The safe-npm FAQ historically said install-time protection was npm-only, while older READMEs mentioned pnpm/yarn wrapping — a documented inconsistency (#999). The CLI now routes `socket npm`, `socket pnpm`, and `socket yarn` through Socket Firewall, so all three block malicious packages before install. Spell this out in the README Usage section so the supported package managers are unambiguous. Refs #999 --- README.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index bbffabfb8c..bce15c70db 100644 --- a/README.md +++ b/README.md @@ -33,10 +33,17 @@ socket package npm/express@4.18.0 # Scan your project's dependencies socket scan create -# Audit an install before it runs +# Audit an install before it runs (npm, pnpm, or yarn) socket npm install +socket pnpm install +socket yarn add ``` +`socket npm`, `socket pnpm`, and `socket yarn` each run the underlying +package manager through [Socket Firewall](https://docs.socket.dev), which +blocks known-malicious packages before they are installed. Install-time +protection is no longer npm-only. + See [the Socket docs](https://docs.socket.dev) for the full command reference. ## Development