Homepage

@pnpm/config@0.0.0-2020821233223

Gets configuration options for pnpm

  • latest version

    1004.11.0

  • latest non vulnerable version

    1004.11.6

  • first published

    8 years ago

  • latest version published

    4 months ago

  • View config package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @pnpm/config package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Unsafe Dependency Resolution

    Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the handling of configDependencies from pnpm-workspace.yaml, where installDeps.ts resolves and spawns a repository-selected native install engine without verifying that the repository is authorized to choose one. An attacker can execute a registry-selected native binary with the victim's filesystem, environment, registry and git or SSH credentials, and network access by publishing a repository that declares pacquet or @pnpm/pacquet in configDependencies, which is then run from node_modules/.pnpm-config. Exploitation requires the victim to run a dependency-management command such as pnpm install in the malicious repository.

    How to fix Unsafe Dependency Resolution?

    Upgrade @pnpm/config to version 1004.11.3 or higher.

    <1004.11.3
    Go back to all versions of this package