diff --git a/internal/npm/npm_test.go b/internal/npm/npm_test.go
index 85f8b70..e41eddc 100644
--- a/internal/npm/npm_test.go
+++ b/internal/npm/npm_test.go
@@ -689,8 +689,8 @@ func TestPnpmLockV9(t *testing.T) {
 		t.Fatalf("Parse failed: %v", err)
 	}
 
-	if len(deps) != 3 {
-		t.Fatalf("expected 3 dependencies, got %d", len(deps))
+	if len(deps) != 90 {
+		t.Fatalf("expected 90 dependencies, got %d", len(deps))
 	}
 
 	depMap := make(map[string]core.Dependency)
@@ -698,11 +698,16 @@ func TestPnpmLockV9(t *testing.T) {
 		depMap[d.Name] = d
 	}
 
-	// All 3 packages
+	// Sample of packages
 	expected := map[string]string{
-		"@babel/helper-string-parser":      "7.27.1",
+		"@babel/helper-string-parser":        "7.27.1",
 		"@babel/helper-validator-identifier": "7.27.1",
-		"@babel/types":                     "7.28.1",
+		"@babel/types":                       "7.28.1",
+		"babel":                              "4.7.16",
+		"mocha":                              "2.5.3",
+		"zod":                                "3.24.2",
+		"acorn":                              "5.7.4",
+		"esprima-fb":                         "15001.1001.0-dev-harmony-fb",
 	}
 
 	for name, wantVer := range expected {
diff --git a/internal/npm/pnpm.go b/internal/npm/pnpm.go
index cbb6028..2adbe3f 100644
--- a/internal/npm/pnpm.go
+++ b/internal/npm/pnpm.go
@@ -24,8 +24,9 @@ func extractPnpmPackageKey(line string) (string, bool) {
 	if len(key) >= 2 && (key[0] == '\'' || key[0] == '"') {
 		key = key[1 : len(key)-1]
 	}
-	// Must start with / or @
-	if len(key) == 0 || (key[0] != '/' && key[0] != '@') {
+	// v5 format starts with /, scoped v6+ starts with @,
+	// non-scoped v6+ (e.g. "acorn@5.7.4") must contain @ as version separator
+	if len(key) == 0 || (key[0] != '/' && key[0] != '@' && !strings.Contains(key, "@")) {
 		return "", false
 	}
 	return key, true