Executive brief
A vulnerability in the pnpm package manager allows for the installation of tampered software packages without detection. pnpm is used by developers to manage project dependencies; if an attacker can modify a project's lockfile and control the package source, they can inject malicious code into the development environment. This bypasses the security checks intended to ensure that downloaded code matches what the developer originally approved.
Technical details
An integrity check bypass exists in pnpm's tarball extraction worker. The 'addTarballToStore' function in 'worker/src/start.ts' uses an optional 'integrity' field; if this field is absent from the 'pnpm-lock.yaml' file, the 'if (integrity)' guard evaluates to false and skips hash verification entirely. An attacker who can modify the lockfile to remove this field and simultaneously compromise the package registry (or perform a man-in-the-middle attack) can serve malicious tarballs that pnpm will accept as legitimate. This vulnerability is particularly impactful when using the '--frozen-lockfile' flag, as it fails open rather than rejecting the insecure configuration. Patches are available in versions 10.34.1 and 11.4.0.
Affected products
- pnpm pnpm >= 11.0.0, < 11.4.0
- pnpm pnpm < 10.34.1
Timeline
- 2026-05-28: disclosed
- 2026-06-25: advisory: NVD publication
- 2026-06-26: patched: GitHub Advisory reviewed and updated