Inside a pnpm workspace, "@acme/utils": "workspace:*" forces the dependency to resolve to the local package and never to the registry, which is what you want during development. On pnpm publish or pnpm pack, pnpm replaces the specifier in the published package.json with a concrete range derived from the local package's version.
The replacement depends on the form used. workspace:* becomes the exact current version, workspace:~ and workspace:^ become the corresponding range. If the local package's version is not one you intend to publish, consumers get a dependency on a version that does not exist on the registry, and their install fails with ETARGET No matching version found.
The practical rule is to publish workspace packages together and to let the release tool set versions before packing. Verify the transformation with pnpm pack and inspecting the package.json inside the resulting tarball; the workspace: string must not survive into the tarball.