pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile (CVE-2026-48995)

The pnpm package manager before versions 10.33.4 and 11.0.7 does not record the hash of dependencies fetched from https://codeload.github.com in its lockfile. Consequently, if the codeload.github.com server is compromised or if an attacker can manipulate the network or machine configuration, pnpm may download and install malicious tarballs without detection. This flaw undermines the integrity guarantees normally provided by the lockfile. The issue is resolved by including the tarball hash in the lockfile starting from versions 10.33.4 and 11.0.7.

An attacker controlling or compromising the codeload.github.com server or the victim's machine configuration can cause pnpm to install arbitrary malicious code by serving manipulated tarballs. This bypasses the lockfile's integrity protection, potentially leading to supply chain compromise. However, exploitation requires either server compromise or local configuration compromise. No known exploits in the wild have been reported.

Upgrade pnpm to version 10.33.4 or later, or 11.0.7 or later, where the vulnerability is fixed by storing the tarball hash in the lockfile. Until then, avoid using pnpm versions prior to these fixed releases for projects relying on GitHub git dependencies. No other mitigations are indicated.