pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle (CVE-2026-55487)

pnpm versions before 10.34.2 and 11.5.3 contain a vulnerability where the generic peer-suffix normalizer strips parenthesized text from various locator types (git, URL, tarball, file, etc.). This normalization causes different source locators to appear identical, allowing an attacker to spoof manifest identity. Consequently, approval for one source string could authorize a malicious source whose locator normalizes to the same value, enabling execution of attacker-controlled lifecycle scripts. The vulnerability is addressed by fixes in pnpm versions 10.34.2 and 11.5.3.

An attacker can exploit this vulnerability to bypass source approval mechanisms by spoofing manifest identities, potentially causing pnpm to run attacker-controlled lifecycle scripts. This can lead to full compromise of the build process, affecting confidentiality, integrity, and availability of the system using pnpm.

Upgrade pnpm to version 10.34.2 or later, or 11.5.3 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.