EUVD-2026-68883

pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...