Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure during pnpm install. An attacker can execute arbitrary code by introducing a malicious git-hosted dependency that leverages prepare, prepublish, or prepack scripts during the fetch phase. Remediation Upgrade...

CVE-2025-69264

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the...

pnpm 安全漏洞

pnpm is a package manager in the pnpm open source. A security vulnerability exists in pnpm versions 10.0.0 through 10.25, which stems from a git-hosted dependency that can execute arbitrary code during installation, potentially leading to remote code execution...