pnpm/pnpm · warning · PnpmError

AUDIT_NO_PACKAGES

AUDIT_NO_PACKAGES

Error message

No installed packages found to audit

What it means

pnpm audit signatures builds its verification request from the lockfile via lockfileToAuditRequest. If the flattened name-to-versions map comes out empty there is nothing to verify, and the command throws AUDIT_NO_PACKAGES rather than reporting a vacuous result.

Source

Thrown at pnpm11/deps/compliance/commands/src/audit/signatures.ts:20

import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package'
import { lockfileToAuditRequest } from '@pnpm/deps.compliance.audit'
import { type SignaturePackage, type SignatureVerificationResult, verifySignatures } from '@pnpm/deps.security.signatures'
import { PnpmError } from '@pnpm/error'
import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header'
import { table } from '@zkochan/table'
import chalk from 'chalk'

import type { AuditOptions } from './audit.js'
import { createAuditNetworkOptions, loadAuditContext } from './auditContext.js'

export async function auditSignatures (opts: AuditOptions): Promise<{ exitCode: number, output: string }> {
  const { envLockfile, include, lockfile } = await loadAuditContext(opts)
  const auditRequest = lockfileToAuditRequest(lockfile, { envLockfile, include })
  const packages: SignaturePackage[] = Object.entries(auditRequest.request).flatMap(([name, versions]) => (
    versions.map((version) => ({ name, registry: pickRegistryForPackage(opts.registries, name), version }))
  ))
  if (packages.length === 0) {
    throw new PnpmError('AUDIT_NO_PACKAGES', 'No installed packages found to audit')
  }

  const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri)
  const networkOptions = createAuditNetworkOptions(opts)
  const result = await verifySignatures(packages, getAuthHeader, {
    ca: networkOptions.ca,
    cert: networkOptions.cert,
    configByUri: networkOptions.configByUri,
    httpProxy: networkOptions.httpProxy,
    httpsProxy: networkOptions.httpsProxy,
    key: networkOptions.key,
    localAddress: networkOptions.localAddress,
    maxSockets: networkOptions.maxSockets,
    networkConcurrency: opts.networkConcurrency,
    noProxy: networkOptions.noProxy,
    retry: networkOptions.retry,
    strictSsl: networkOptions.strictSsl,
    timeout: networkOptions.fetchTimeout,

View on GitHub (pinned to 5b11d3a15b)

Solutions

1. Add or install at least one dependency before auditing signatures
2. Skip pnpm audit signatures on projects known to have no dependencies
3. Check that --prod/--dev/--no-optional flags are not filtering out the entire dependency set

Example fix

# before
pnpm init
pnpm audit signatures # nothing to audit

# after
pnpm add lodash
pnpm audit signatures

import { lockfileToAuditRequest } from '@pnpm/audit'

const auditRequest = lockfileToAuditRequest(lockfile, { envLockfile, include })
const packageCount = Object.values(auditRequest.request).reduce((n, versions) => n + versions.length, 0)
if (packageCount === 0) {
  console.log('No installed packages to audit — skipping signature audit.')
  process.exitCode = 0
}

function lockfileHasPackages (lockfile: { importers?: Record<string, { dependencies?: object, devDependencies?: object, optionalDependencies?: object }> }): boolean {
  return Object.values(lockfile.importers ?? {}).some(imp =>
    Object.keys(imp.dependencies ?? {}).length +
    Object.keys(imp.devDependencies ?? {}).length +
    Object.keys(imp.optionalDependencies ?? {}).length > 0)
}

When it happens

Trigger: Running pnpm audit signatures in a project whose lockfile contains zero dependencies; include filters (--prod/--dev/--no-optional combinations) excluding every dependency from the request.

Common situations: Brand-new packages before any dependency is added; CI templates that run signature audits unconditionally; over-restrictive include flags.

Related errors

• AUDIT_UNKNOWN_SUBCOMMAND
• AUDIT_NO_LOCKFILE
• AUDIT_NO_LOCKFILE
• PATCH_FILE_PATH_MISSING
• MISSING_PACKAGE_NAME

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/2c3899f26694355d. Report an issue: GitHub.