npm

pnpm

28 Total advisories

28 Vulnerabilities

0 Malware

Dependency scanning

Check whether pnpm is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

pnpm

Vulnerabilities

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Hoisted install imports lockfile alias outside node_modules

pnpm: `patch-remove` could delete project-selected files outside the patches directory

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

pnpm: Reserved bin name deletes PNPM_HOME during global remove

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

pnpm: Unsafe default behavior breaks integrity check

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

pnpm vulnerable to Command Injection via environment variable substitution

pnpm has Path Traversal via arbitrary file permission modification

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

pnpm has symlink traversal in file:/git dependencies

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

pnpm has Windows-specific tarball Path Traversal

pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

pnpm incorrectly parses tar archives relative to specification

Untrusted Search Path in PNPM

Browse more npm advisories

Start Securing