Right, pnpm sbom only emits purls today, no CPE field.

For npm that's usually less of a loss than it sounds. Most npm packages don't have an official CPE, and the ones Syft prints are generated guesses, which is where a lot of Dependency-Track false positives come from.

What I'd do is turn on DT's purl-based sources: GitHub Advisories (needs a token, best npm coverage), OSV with npm selected, and OSS Index. All of them match on pkg:npm/..., so the pnpm SBOM gets scanned fine without CPEs.

If some compliance tool really needs NVD/CPE matching, keep Syft for that output. But try the purl analyzers first.

if npm cli prints it, i don't have objections