[BUG] `npm audit` erroneously reports issue when workspace named the same as an npm package about cli HOT 2 CLOSED

This is on purpose. npm has no way of knowing that workspace isn't the real svelte package. The audit ecosystem is keyed by name, that's how it works. If I installed lodash from its git repo I'd still expect the same warnings as if I'd installed from the npm registry.

Scopes (aka @namespace/package) are the solution to name collisions like this, it's highly recommended you utilize them.

from cli.

@wraithgar Please can I suggest that you review and expand the documentation for workspaces because it makes no mention of this behaviour - indeed, the examples show this exact usage without mentioning the potential for conflict.

Also your mention of 'namespaces' is unhelpful because this doesn't appear to be terminology used by npm - it uses 'scopes'. I actually can't reconcile what you've said with the scopes documentation and how that impacts how I would use workspaces.

What I was trying to do here was segment a project where I'm evaluating different dev frameworks - I've not intention of publishing. Perhaps workspaces is the wrong way to go about this and I'm misusing npm.

from cli.