Advisory · CVE-2026-101043
pnpm workspace proxy settings exfiltrated environment secrets
pnpm expanded ${VAR} placeholders in proxy settings from a repo-controlled pnpm-workspace.yaml, routing install traffic and secrets like NPM_TOKEN through attacker hosts.
- Vendor
- pnpm
- Product
- pnpm
- Identifier / CWE
- CVE-2026-101043
CWE-201 - Action timing
- Immediate
Explain it like I’m five
pnpm read a delivery note from a stranger's repository and filled in the blanks with your secrets, then mailed the whole package, and the delivery route itself, straight to the stranger's address.
- 01Malicious workspace file
The attacker controls a repository whose pnpm-workspace.yaml sets httpProxy, httpsProxy, or noProxy with ${VAR} placeholders.
- 02Victim clones and runs
The victim clones the repository and runs a pnpm command, such as pnpm install.
- 03Secrets expanded
During configuration loading, before any lifecycle script executes, pnpm expands environment secrets such as NPM_TOKEN or GITHUB_TOKEN into the proxy hostname or userinfo.
- 04Traffic rerouted
Install traffic, and the corresponding DNS lookups, route through the attacker-controlled host, exposing the secrets.
What happened
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expanded ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project’s pnpm-workspace.yaml. Because the manifest is repository-controlled, and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry and related keys), an attacker who controls a repository’s pnpm-workspace.yaml could cause a victim who clones the repository and runs a pnpm command to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo, routing install traffic and the corresponding DNS lookups through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes.
The flaw is fixed in pnpm 11.11.0 and 10.34.5.
What to do
- Upgrade pnpm to 11.11.0 or 10.34.5, depending on your release line.
- Review recent clones of unfamiliar repositories where pnpm commands were run, and check for pnpm-workspace.yaml files containing proxy settings with ${VAR} placeholders.
- Inspect DNS and proxy logs for install-time requests resolving to unexpected hosts.
- Rotate NPM_TOKEN, GITHUB_TOKEN, and any other secrets present in the environment during installs from untrusted repositories.
Management note
This is a supply-chain shaped problem wearing a configuration bug’s clothes: cloning a repo and running install is routine developer behavior, and the secret left the machine before any script ran. Treat untrusted-repo installs as a threat model, and rotate the tokens now rather than after the log review.