Skip to content
Threat Feed
Subscribe

Vendor

Pnpm

2 briefs RSS
high advisory

Arbitrary Environment Variable Disclosure via pnpm-workspace.yaml

Vulnerable pnpm versions expand sensitive environment variables within proxy settings in malicious pnpm-workspace.yaml files, enabling credential exfiltration during configuration loading.

pnpm +2 supply-chain vulnerability credential-theft
3t 1c
high advisory

Environment Secret Exfiltration via pnpm-workspace.yaml Proxy Settings

A vulnerability in pnpm allows local environment variable exfiltration when a user executes 'pnpm install' in a malicious repository containing a crafted 'pnpm-workspace.yaml' file.

pnpm +3 supply-chain exfiltration vulnerability path-traversal
5t updated