Resources Downloaded over Insecure Protocol

Overview @pnpm/package-store is an A storage for packages Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol due to the absence of integrity hashes in the lockfile for HTTP or git-hosted tarball dependencies. An attacker can execute arbitrary code by...

@kcconfigs/commitlint (>=0.1.0-beta.2, <=0.2.0), @pnpm/cache.commands (1000.0.52) +29 more potentially affected by CVE-2025-69263 via @pnpm/package-store (1007.0.0)

@pnpm/package-store NPM version 1007.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @pnpm/package-store and may be impacted: - @kcconfigs/commitlint =0.1.0-beta.2, =0.2.0 - @pnpm/cache.commands 1000.0.52 - @pnpm/cli-utils 1001.2.17 -...