{
  lib,
  stdenv,
  buildNpmPackage,
  fetchFromGitHub,
  nodejs,
  pnpm,
  cacert,
}:

buildNpmPackage rec {
  pname = "ni";
  version = "23.2.0";

  src = fetchFromGitHub {
    owner = "antfu-collective";
    repo = "ni";
    tag = "v${version}";
    hash = "sha256-f210qz53IgUXDon4bWIp+dynJ3aWi0za0puPjplzmqg=";
  };

  buildInputs = [
  ];
  nativeBuildInputs = [
    nodejs
  ];
  npmConfigHook = pnpm.configHook;
  npmDeps = pnpmDeps;
  pnpmDeps = pnpm.fetchDeps {
    inherit pname version src;
    hash = "sha256-+hnkj0uevURkRboTH8WbSt82pZTdWL4ii1PKr6NO0Cg=";
  };


  meta = {
    description = "Use the right package manager";
    homepage = "https://github.com/antfu-collective/ni";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
  };
}

This raise a error on macOS

       >  UNABLE_TO_GET_ISSUER_CERT_LOCALLY  request to https://registry.npmjs.org/@eslint/core/-/core-0.9.0.tgz failed, reason: unable to get local issuer certificate
       >
       > FetchError: request to https://registry.npmjs.org/@eslint/core/-/core-0.9.0.tgz failed, reason: unable to get local issuer certificate
       >     at ClientRequest.<anonymous> (/nix/store/hhprmwazmgvxqff5zpra2bw0cb12f4sl-pnpm-9.15.3/libexec/pnpm/dist/pnpm.cjs:66979:18)
       >     at ClientRequest.emit (node:events:518:28)
       >     at emitErrorEvent (node:_http_client:103:11)
       >     at TLSSocket.socketErrorListener (node:_http_client:506:5)
       >     at TLSSocket.emit (node:events:518:28)
       >     at emitErrorNT (node:internal/streams/destroy:170:8)
       >     at emitErrorCloseNT (node:internal/streams/destroy:129:3)
       >     at process.processTicksAndRejections (node:internal/process/task_queues:90:21)
       > Progress: resolved 685, reused 0, downloaded 0, added 0
       For full logs, run 'nix log /nix/store/i13ksyg9fqd8rlc3dywlarsvm5ix2cbn-ni-pnpm-deps.drv'.

In reply to @xiaoxiangmoe:matrix.org
Is there anyway to add cacert for pnpm.fetchDeps in macOS?

But this also not working

 WARN  GET https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.4.1.tgz error (UNABLE_TO_GET_ISSUER_CERT_LOCALLY). Will retry in 1 minute. 1 retries left.

After setting up my aforementioned pnpm build, I am now wondering why the devshell and build derivations behave differently. My outputs look like this:

      devShells.default = pkgs.mkShellNoCC {
        inherit pnpmDeps cargoDeps;
        inputsFrom = [ self.packages.${system}.default ];
      };

      packages.default = pkgs.stdenvNoCC.mkDerivation (finalAttrs: {
        inherit pnpmDeps cargoDeps pname version;
        src = gitignoreSource ./.;
        strict = true;
        doCheck = false;
        nativeBuildInputs = with pkgs; [
          wasm-bindgen-cli
          nodejs
          nodejs.pkgs.pnpm.configHook
          pkgs.rustPlatform.cargoSetupHook
          wrappedWasmPack
          (rust-bin.stable.latest.default.override {targets = ["wasm32-unknown-unknown"];})
        ];

        buildPhase = ''
          pnpm build
        '';
        installPhase = ''
          mv dist/ $out
        '';
      });

The packaging derivation works exactly how I want it. But the devshell does not. Specifically, while in the packaging derivation all the dependencies are installed and then all I need to do is run "pnpm build" in the build phase as shown. But in the dev shell when I execute "pnpm build" pnpm complains that I need to install the dependencies still.

Is there something I am missing? Is mkshell different from mkderivation in a way that prevents this? Obviously it is impure, but I'd like to confine the dependencies in the store as much as I can.