Executive brief
pnpm is a Node.js package manager that installs dependencies for JavaScript projects. When a developer clones a malicious repository and runs pnpm install, an attacker can inject environment variable placeholders into proxy settings in the project's configuration file. This causes pnpm to expose sensitive credentials like NPM_TOKEN or GITHUB_TOKEN by routing traffic through an attacker-controlled server, leaking secrets before any project code executes.
Technical details
pnpm expands ${VAR} environment-variable placeholders in httpProxy, httpsProxy, and noProxy settings read from pnpm-workspace.yaml. These proxy configuration keys were omitted from the request-destination key set that suppresses placeholder expansion for untrusted manifests, creating a bypass of an existing security boundary already applied to registry and pnprServer keys. An attacker controlling a repository's pnpm-workspace.yaml can embed environment secrets into proxy hostnames or userinfo, exfiltrating them during configuration loading via DNS lookups and HTTP requests to the attacker's host, requiring only user interaction (cloning and running pnpm).
Affected products
- pnpm pnpm >=11.0.0, <11.11.0 and >=10.7.0, <10.34.5
Timeline
- 2026-09-27: disclosed
- 2026-09-27: patched: pnpm 11.11.0 and 10.34.5