An attacker can create a malicious pnpm-workspace.yaml file within a repository that references sensitive environment variables such as NPM_TOKEN or GITHUB_TOKEN. When a victim clones the repository and executes a pnpm command like pnpm install, the pnpm client expands these variables into the proxy configuration. This leads to the exfiltration of the token values via DNS queries or HTTP traffic routed through an attacker-controlled proxy server. This vulnerability allows for unauthorized access to private package registries and CI/CD environments.

Attack Chain

1. Attacker creates a malicious repository containing a crafted pnpm-workspace.yaml file.
2. Attacker sets the httpProxy or httpsProxy key in the manifest to include an environment variable placeholder (e.g., ${NPM_TOKEN}).
3. Attacker lures a victim to clone the repository into their local environment.
4. Victim executes a standard pnpm command (e.g., pnpm install) within the root of the cloned repository.
5. pnpm loads the pnpm-workspace.yaml manifest and parses the proxy configuration.
6. The client engine expands the placeholder ${NPM_TOKEN} into its actual sensitive value.
7. The pnpm process triggers a network connection or DNS lookup toward an attacker-controlled proxy host, appending the expanded token to the request metadata.
8. Attacker logs the incoming connection or DNS request on their infrastructure to capture the exfiltrated secret.

Impact

Successful exploitation leads to the theft of sensitive development credentials, including NPM_TOKEN and GITHUB_TOKEN. This allows attackers to authenticate as the victim, potentially accessing private repositories, stealing proprietary source code, or injecting malicious packages into the software supply chain.

Recommendation

• Upgrade pnpm to version 11.11.0 or 10.34.5 immediately to include the fix that prevents environment variable expansion in untrusted proxy configurations.
• Implement repository scanning tools to detect pnpm-workspace.yaml files containing suspicious proxy configurations or references to environment variable patterns.
• Rotate all credentials that may have been stored in local environment variables (e.g., NPM_TOKEN, GITHUB_TOKEN) if they were used in environments where malicious repositories were cloned and processed.