From what we found out on PNPM, it seems there is no difference on the package.json file. It mainly does a better job in handling the node modules.

So essentially that means it doesn’t matter you run npm install or pnpm install. Both will work seamlessly, it is alomst just a matter of having both 

npm and pnpm installed on the system where you run the scan!

Running Veracode's agent based SCA won’t be able to run pnpm install as we don’t have that support built in. However if npm is also running on the same system you will still get the full scan and results showing up.

With this little workaround you will able to scan all your pnpm projects as well. Just install npm on your local system and it will start working.

Keep in mind to remove the node_modules folder before you run npm install as it otherwise will fail.

On CI system, I believe in many cases this will just work right away. If a standard runner like ubuntu-latest is used, npm should be available and the scan will just run.

The full workaround on your local system would be this one

## Clone

git clone https://github.com/kevinmarrec/unocss.git

## move in to folder

cd unocss

## run pnpm install

pnpm install --shamefully-hoist

## archive or detele existing package.json

mv package.json backup_package.json

## initiate new npm project, which generates a new package.json

npm init

## remove node_modules folder

rm -rf node_modules

### OPTIONAL - Run npm install

npm install

## run SCA agent scan

srcclr scan . --allow-dirty