You run pnpm audit in CI. It prints No known vulnerabilities found. The build goes green and you move on.
Then someone runs npm audit on the same repo, same lockfile, same afternoon — and gets a list of advisories.
Neither command is broken. They disagree for the same reason a clean result from either one proves less than most teams assume, and it comes down to a single design fact about what audit actually is.
audit is a network request, not a scanner
There is no local analysis happening. When you run npm audit or pnpm audit, the client sends a description of your resolved dependency tree to your configured registry's audit endpoint, and prints the advisories that come back. That advisory data traces to the GitHub Advisory Database, which curates known vulnerabilities for the npm ecosystem.
