Dsherret

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.33.4 pnpm versions prior to 11.0.7 **Description** A flaw exists where the package manager does not store the hash of dependencies sourced from `codeload.github.com` in the lockfile. Consequently, a compromised server or machine configuration could allow a malicious server to serve arbitrary tarballs that the software would install regardless of the lockfile's state. **Recommendations** Update to version 10.33.4 or later. Update to version 11.0.7 or later.