{
  "title": "pnpm Package-Manager Supply-Chain Advisory Batch",
  "summary": "pnpm disclosed a cluster of package-manager vulnerabilities affecting lockfile integrity, Git dependency fetching, repository registry configuration, patch application, and symlink creation; responders should inventory vulnerable pnpm versions and review credential-bearing install paths.",
  "date": "2026-06-27",
  "severity": "high",
  "tags": [
    "pnpm",
    "npm",
    "package-manager",
    "lockfile-integrity",
    "ci-cd"
  ],
  "sources_count": 8,
  "indicators": {
    "slug": "pnpm-package-manager-supply-chain-advisory-batch",
    "since": "2026-05-25T09:07:31Z",
    "until": "not_applicable",
    "ecosystem": "npm",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "pnpm"
    ],
    "packages": [
      "pnpm"
    ],
    "versions": [
      "pnpm < 10.34.2",
      "pnpm >= 11.0.0"
    ],
    "affectedVersions": [
      "pnpm < 10.34.2",
      "pnpm >= 11.0.0"
    ],
    "fixedVersions": [],
    "files": [
      "package.json",
      "pnpm-lock.yaml",
      "pnpm-workspace.yaml",
      ".npmrc",
      "*.patch",
      ".github/workflows"
    ],
    "paths": [],
    "services": [],
    "domains": [
      "codeload.github.com"
    ],
    "urls": [
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-hg3w-7f8c-63hp",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcp",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-p4xf-rf54-rj3x",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-hwx4-2j3j-g496",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4",
      "https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r"
    ],
    "ips": [],
    "hashes": [],
    "processPatterns": [
      "pnpm install",
      "pnpm add",
      "pnpm view",
      "pnpm patch",
      "git fetch"
    ],
    "networkPatterns": [
      "registry=",
      "Authorization"
    ],
    "telemetrySelectors": []
  }
}