Executive brief
pnpm, a popular JavaScript package manager, fails to verify the integrity of dependencies downloaded directly from GitHub. This flaw could allow a compromised server or a local machine configuration to substitute legitimate software with malicious code without the user's knowledge. If exploited, this could lead to the installation of malware or unauthorized access to development environments and production systems.
Technical details
pnpm is vulnerable to a missing support for integrity check (CWE-353) when handling GitHub git dependencies. The lockfile (v9.0) fails to store a cryptographic hash for tarballs fetched from codeload.github.com, relying instead on the commit shorthand in the URL. An attacker who can compromise the download server or manipulate a user's network/machine configuration can serve a malicious tarball that pnpm will install without warning, as there is no hash to validate against. This affects pnpm versions prior to 10.33.4 and 11.x versions prior to 11.0.7. Patches are available in versions 10.33.4 and 11.0.7.
Affected products
- pnpm pnpm < 10.33.4, >= 11.0.0 < 11.0.7
Timeline
- 2026-05-25: disclosed: Advisory published to pnpm/pnpm repository
- 2026-06-25: advisory: NVD published the vulnerability
- 2026-06-26: patched: GitHub Advisory Database updated with patched versions