EUVD-2026-39487

pnpm: stage download writes outside its destination directory via manifest name/version traversal...