Executive brief
pnpm is a Node.js package manager used to install and manage dependencies across millions of projects. An attacker can craft malicious packages with carefully engineered names that collide under pnpm's MD5-based path hashing function, causing one package version to be silently replaced by another in the node_modules directory. This enables supply chain attacks where vulnerable package versions are substituted without detection or errors during installation.
Technical details
The vulnerability stems from pnpm's use of MD5 hashing in the depPathToFilename() function to shorten long package paths. When two distinct packages (packageA@1.2.3 and packageB@3.4.5) can be engineered to produce the same MD5 hash, they are assigned the same installation directory despite different names. An attacker can craft package names up to 214 bytes (npm's limit) to force hash collisions, particularly targeting shared dependencies. When a later-installed package collides with an earlier one, the directory is reused, causing the shared child dependency's version to be overwritten. No installation errors are triggered. The fix is to replace MD5 with SHA256. This vulnerability requires network access and attacker-controlled package publication but no authentication or user interaction.
Affected products
- pnpm pnpm <10.0.0
Timeline
- 2025-04-23: disclosed
- 2025-04-23: patched: Fixed in version 10.0.0