Executive brief
pnpm is a popular package manager used by developers to manage software dependencies. A vulnerability exists where certain types of dependencies (specifically those hosted as HTTP or Git tarballs) are saved without security fingerprints in the project's lockfile. This allows a malicious server to swap safe code for malicious code during subsequent installations, potentially leading to the execution of unauthorized software in developer environments or automated build systems.
Technical details
A vulnerability in pnpm's tarball resolver (specifically within the resolving/tarball-resolver component) causes it to omit integrity hashes when processing HTTP/HTTPS tarball URLs and Git-hosted dependencies. Because the lockfile lacks an 'integrity' field for these entries, pnpm cannot verify if the downloaded content has changed since the initial resolution. An attacker who controls the remote server or the dependency tree can perform a supply chain attack by serving benign code during initial audits and malicious code during later CI/CD runs or user installs. This issue affects HTTP/HTTPS URLs, Git shorthand (e.g., github:user/repo), and Git URLs, but does not affect standard npm registry packages. The vulnerability is fixed in version 10.26.0.
Affected products
- pnpm pnpm < 10.26.0
Timeline
- 2026-01-07: disclosed
- 2026-01-07: advisory
- 2026-01-07: patched: Fixed in version 10.26.0