diff --git a/docs/npm_import.md b/docs/npm_import.md
index a1bdfe6b9..379a107d3 100644
--- a/docs/npm_import.md
+++ b/docs/npm_import.md
@@ -27,7 +27,7 @@ Advanced users may want to directly fetch a package from npm rather than start f
 
 <pre>
 translate_pnpm_lock(<a href="#translate_pnpm_lock-name">name</a>, <a href="#translate_pnpm_lock-custom_postinstalls">custom_postinstalls</a>, <a href="#translate_pnpm_lock-dev">dev</a>, <a href="#translate_pnpm_lock-lifecycle_hooks_exclude">lifecycle_hooks_exclude</a>, <a href="#translate_pnpm_lock-no_optional">no_optional</a>,
-                    <a href="#translate_pnpm_lock-patch_args">patch_args</a>, <a href="#translate_pnpm_lock-patches">patches</a>, <a href="#translate_pnpm_lock-pnpm_lock">pnpm_lock</a>, <a href="#translate_pnpm_lock-prod">prod</a>, <a href="#translate_pnpm_lock-repo_mapping">repo_mapping</a>, <a href="#translate_pnpm_lock-run_lifecycle_hooks">run_lifecycle_hooks</a>, <a href="#translate_pnpm_lock-yq">yq</a>)
+                    <a href="#translate_pnpm_lock-patch_args">patch_args</a>, <a href="#translate_pnpm_lock-patches">patches</a>, <a href="#translate_pnpm_lock-pnpm_lock">pnpm_lock</a>, <a href="#translate_pnpm_lock-prod">prod</a>, <a href="#translate_pnpm_lock-repo_mapping">repo_mapping</a>, <a href="#translate_pnpm_lock-run_lifecycle_hooks">run_lifecycle_hooks</a>)
 </pre>
 
 Repository rule to generate npm_import rules from pnpm lock file.
@@ -136,7 +136,6 @@ and must depend on packages with their versioned label like `@npm__types_node-15
 | <a id="translate_pnpm_lock-prod"></a>prod |  If true, only install dependencies   | Boolean | optional | False |
 | <a id="translate_pnpm_lock-repo_mapping"></a>repo_mapping |  A dictionary from local repository name to global repository name. This allows controls over workspace dependency resolution for dependencies of this repository.&lt;p&gt;For example, an entry <code>"@foo": "@bar"</code> declares that, for any time this repository depends on <code>@foo</code> (such as a dependency on <code>@foo//some:target</code>, it should actually resolve that dependency within globally-declared <code>@bar</code> (<code>@bar//some:target</code>).   | <a href="https://bazel.build/docs/skylark/lib/dict.html">Dictionary: String -> String</a> | required |  |
 | <a id="translate_pnpm_lock-run_lifecycle_hooks"></a>run_lifecycle_hooks |  If true, runs preinstall, install and postinstall lifecycle hooks on npm packages if they exist   | Boolean | optional | True |
-| <a id="translate_pnpm_lock-yq"></a>yq |  The label to the yq binary to use.         If executing on a windows host, the .exe extension will be appended if there is no .exe, .bat, or .cmd extension on the label.   | <a href="https://bazel.build/docs/build-ref.html#labels">Label</a> | optional | @yq//:yq |
 
 
 <a id="#npm_import"></a>
diff --git a/js/private/BUILD.bazel b/js/private/BUILD.bazel
index 538d31c65..43381f53a 100644
--- a/js/private/BUILD.bazel
+++ b/js/private/BUILD.bazel
@@ -80,7 +80,6 @@ bzl_library(
     visibility = ["//js:__subpackages__"],
     deps = [
         ":pnpm_utils",
-        ":repo_toolchains",
         ":starlark_codegen_utils",
         ":transitive_closure",
         "@bazel_skylib//lib:dicts",
@@ -92,6 +91,7 @@ bzl_library(
     name = "pnpm_utils",
     srcs = ["pnpm_utils.bzl"],
     visibility = ["//js:__subpackages__"],
+    deps = [":yaml"],
 )
 
 bzl_library(
diff --git a/js/private/pnpm_utils.bzl b/js/private/pnpm_utils.bzl
index e31a0463a..29e9ff3ea 100644
--- a/js/private/pnpm_utils.bzl
+++ b/js/private/pnpm_utils.bzl
@@ -1,5 +1,7 @@
 "Utility functions for npm rules"
 
+load(":yaml.bzl", _parse_yaml = "parse")
+
 def _bazel_name(name, pnpm_version = None):
     "Make a bazel friendly name from a package name and (optionally) a version that can be used in repository and target names"
     escaped_name = name.replace("@", "at_").replace("/", "_")
@@ -35,6 +37,17 @@ def _parse_pnpm_name(pnpmName):
         fail("unexpected pnpm versioned name " + pnpmName)
     return segments
 
+def _parse_pnpm_lock(lockfile_content):
+    """Parse a pnpm lock file.
+
+    Args:
+        lockfile_content: yaml lockfile content
+
+    Returns:
+        dict containing parsed lockfile
+    """
+    return _parse_yaml(lockfile_content)
+
 def _assert_lockfile_version(version, testonly = False):
     if type(version) != type(1.0):
         fail("version should be passed as a float")
@@ -74,6 +87,7 @@ pnpm_utils = struct(
     pnpm_name = _pnpm_name,
     assert_lockfile_version = _assert_lockfile_version,
     parse_pnpm_name = _parse_pnpm_name,
+    parse_pnpm_lock = _parse_pnpm_lock,
     friendly_name = _friendly_name,
     virtual_store_name = _virtual_store_name,
     strip_peer_dep_version = _strip_peer_dep_version,
diff --git a/js/private/translate_pnpm_lock.bzl b/js/private/translate_pnpm_lock.bzl
index 1e41699da..85200a2ac 100644
--- a/js/private/translate_pnpm_lock.bzl
+++ b/js/private/translate_pnpm_lock.bzl
@@ -5,7 +5,6 @@ load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(":pnpm_utils.bzl", "pnpm_utils")
 load(":transitive_closure.bzl", "translate_to_transitive_closure")
 load(":starlark_codegen_utils.bzl", "starlark_codegen_utils")
-load(":repo_toolchains.bzl", "yq_path")
 
 _DOC = """Repository rule to generate npm_import rules from pnpm lock file.
 
@@ -139,22 +138,11 @@ _ATTRS = {
         doc = """If true, runs preinstall, install and postinstall lifecycle hooks on npm packages if they exist""",
         default = True,
     ),
-    "yq": attr.label(
-        doc = """The label to the yq binary to use.
-        If executing on a windows host, the .exe extension will be appended if there is no .exe, .bat, or .cmd extension on the label.""",
-        default = "@yq//:yq",
-    ),
 }
 
 def _process_lockfile(rctx):
-    json_lockfile_path = rctx.path("pnpm-lock.json")
-    result = rctx.execute([yq_path(rctx), "-o=json", ".", rctx.path(rctx.attr.pnpm_lock)])
-    if result.return_code != 0:
-        fail("failed to convert pnpm lockfile to json: %s" % result.stderr)
-    rctx.file(json_lockfile_path, result.stdout)
-
-    json_lockfile = json.decode(rctx.read(json_lockfile_path))
-    return translate_to_transitive_closure(json_lockfile, rctx.attr.prod, rctx.attr.dev, rctx.attr.no_optional)
+    lockfile = pnpm_utils.parse_pnpm_lock(rctx.read(rctx.path(rctx.attr.pnpm_lock)))
+    return translate_to_transitive_closure(lockfile, rctx.attr.prod, rctx.attr.dev, rctx.attr.no_optional)
 
 _NPM_IMPORT_TMPL = \
     """    npm_import(