Highzkochan

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.2 pnpm versions prior to 11.5.3 **Description** The generic peer-suffix normalizer incorrectly strips parenthesized text from git, URL, tarball, file, and other opaque locators. This behavior allows a scenario where approval for one source string could inadvertently authorize a different, attacker-controlled source that normalizes to the same value. **Recommendations** Update to version 10.34.2. Update to version 11.5.3.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 10.34.2 pnpm versions prior to 11.5.3 **Description** pnpm allows the installation of `configDependencies` declared in `pnpm-workspace.yaml` before command dispatch. A repository can declare `pacquet` or `@pnpm/pacquet` as a config dependency, which pnpm treats as an install-engine opt-in. During the installation process, pnpm resolves a platform-specific `@pacquet/<platform>-<arch>/pacquet` binary from `node modules/.pnpm-config/<packageName>` and executes it with the privileges of the developer or CI user. **Recommendations** Update pnpm to version 10.34.2 or later. Update pnpm to version 11.5.3 or later.

**Name of the Vulnerable Software and Affected Versions** pnpm versions prior to 7.33.4 pnpm versions prior to 8.6.8 **Description** The issue arises from how pnpm parses tar archives, allowing a tarball to be constructed that appears safe when installed via npm or parsed by the registry but is malicious when installed via pnpm. This can result in a package that seems safe on the npm registry or when installed via npm being replaced with a compromised or malicious version when installed via pnpm. The TAR format's append-only nature and the specification for updating files can lead to multiple copies of a file, such as `package.json`, in an archive, with the expected behavior being that all versions other than the last are ignored during extraction. However, pnpm extracts only the first file of a given name and discards subsequent files with the same name. **Recommendations** For pnpm versions prior to 7.33.4, update to version 7.33.4 or later. For pnpm versions prior to 8.6.8, update to version 8.6.8 or later. As a temporary workaround, consider avoiding the use of pnpm for installing packages until a patched version is applied.