pnpm
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 28 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 21, 2022 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
pnpm: hoisted install imports lockfile alias outside node_modules
pnpm: patch-remove could delete project-selected files outside the patches directory
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
pnpm: Unsafe default behavior breaks integrity check
Monitor pnpm in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.