Executive brief
pnpm is a fast package manager used by developers to install and manage JavaScript dependencies. pnpm v10 introduced a security feature to prevent malicious packages from automatically running installation scripts, protecting developers from supply chain attacks. However, this protection was accidentally bypassed for git-hosted dependencies—allowing attackers to inject malicious code that runs without warning during installation. An attacker could compromise a git repository and add code that steals secrets, modifies source code, or establishes persistence on a developer's machine or CI/CD pipeline.
Technical details
This is a protection mechanism bypass (CWE-693) in the pnpm package manager. pnpm v10 introduced onlyBuiltDependencies, an allowlist that blocks packages from executing lifecycle scripts during the BUILD phase. However, git-hosted dependencies are processed in a separate FETCH phase via preparePackage(), which only checks the ignoreScripts flag (which defaults to false) and never consults onlyBuiltDependencies. This means git dependencies can execute prepare, prepublish, and prepack scripts even when the global security policy disables scripts. Attack vectors include git+https://, github:, gitlab:, bitbucket:, git+ssh://, and git+file:// protocols. The vulnerability requires network/local access and user interaction (running pnpm install), but no privileges are needed. Attackers can achieve arbitrary code execution with victim privileges. The patch was released in pnpm v10.26.0, implementing a blockExoticSubdeps option to restrict transitive dependencies to trusted sources.
Affected products
- npm pnpm >=10.0.0, <10.26.0
Timeline
- 2026-01-07: disclosed
- 2026-01-10: patched: v10.26.0 includes blockExoticSubdeps feature to restrict exotic subdependencies