Security vulnerabilities and automated fixes for pnpm issues
4 posts found
A pnpm workspace configuration in `site-astro/pnpm-workspace.yaml` was missing critical supply chain security settings including `minimumReleaseAge`, `trustPolicy`, and `blockExoticSubdeps`. Without these protections, the project could install freshly published malicious packages within minutes of their release. The fix adds a 7-day quarantine period, downgrade protection, and exotic subdependency blocking.
A missing `trustPolicy` configuration in `pnpm-workspace.yaml` left a Node.js library vulnerable to supply chain attacks where malicious package updates could downgrade security settings. Combined with insufficient input validation in the todo application component, this created a medium-severity attack surface. The fix adds `trustPolicy: no-downgrade`, `blockExoticSubdeps: true`, and `minimumReleaseAge: 10080` to harden the package manager configuration.
A pnpm workspace configuration was missing the `minimumReleaseAge` setting, meaning freshly published — and potentially malicious or unstable — npm packages could be installed immediately. By adding `minimumReleaseAge: 10080` to `pnpm-workspace.yaml`, the project now enforces a seven-day waiting period before any newly released package version can be installed. This single configuration change significantly reduces the attack surface for supply chain attacks targeting this Node.js library and it
A medium-severity Denial of Service vulnerability (CVE-2026-42036) was discovered in axios 1.12.2, where using `responseType: 'stream'` could allow an attacker to exhaust server memory through unbounded stream consumption. The fix upgrades axios from version 1.12.2 to 1.15.1 in the project's `pnpm-lock.yaml`, closing the attack surface before it could be exploited in production.