pnpm: Unsafe default behavior breaks integrity check (CVE-2026-50573)

The vulnerability in pnpm affects versions prior to 10.34.0 and 11.4.0. When running `pnpm install` in non-frozen mode, if the downloaded package tarball does not match the integrity recorded in pnpm-lock.yaml, pnpm initially reports an integrity mismatch. However, instead of halting, pnpm performs a resolution repair, accepts the new integrity from the registry, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not enforce a hard stop by default, allowing potentially altered or malicious package content to be installed despite integrity mismatches. This behavior is fixed in versions 10.34.0 and 11.4.0.

This vulnerability allows an attacker who can alter the package content served by the registry (for a package already locked with an integrity value) to bypass the integrity check and have the altered package installed. This can lead to the installation of malicious or tampered packages despite the presence of a lockfile integrity value, potentially compromising the security and trustworthiness of the software supply chain. The CVSS score of 6.8 indicates a medium severity with high impact on confidentiality and integrity but no impact on availability.

Upgrade pnpm to version 10.34.0 or later, or 11.4.0 or later, where this vulnerability is fixed. These versions enforce the integrity check properly and do not accept altered package content silently. Until upgraded, avoid running `pnpm install` in non-frozen mode if strict integrity verification is required.