npm/pnpm

pnpm vulnerable to Command Injection via environment variable substitution

Modified: 2/3/2026

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Modified: 9/1/2026

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

Modified: 2/3/2026

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

Modified: 6/26/2026

pnpm: Reserved bin name deletes PNPM_HOME during global remove

Modified: 6/27/2026

pnpm: Unsafe default behavior breaks integrity check

Modified: 6/26/2026

pnpm incorrectly parses tar archives relative to specification

Modified: 9/10/2026

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

Modified: 6/26/2026

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

Modified: 2/3/2026

pnpm has Windows-specific tarball Path Traversal

Modified: 2/3/2026

pnpm: `patch-remove` could delete project-selected files outside the patches directory

Modified: 7/8/2026

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

Modified: 2/3/2026

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Modified: 4/23/2025

Untrusted Search Path in PNPM

Modified: 11/8/2023

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Modified: 9/2/2026

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Modified: 6/26/2026

pnpm: Hoisted install imports lockfile alias outside node_modules

Modified: 7/8/2026

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

Modified: 8/28/2026

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Modified: 6/26/2026

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Modified: 6/26/2026

pnpm has symlink traversal in file:/git dependencies

Modified: 2/3/2026

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Modified: 6/26/2026

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

Modified: 6/26/2026

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

Modified: 7/8/2026

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Modified: 6/26/2026

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

Modified: 6/27/2026

pnpm has Path Traversal via arbitrary file permission modification

Modified: 2/3/2026

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

Modified: 9/10/2026

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Modified: 9/2/2026

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Modified: 9/28/2026

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Modified: 6/26/2026

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

Modified: 2/3/2026