pnpm is a package manager

pnpm gates lifecycle script execution (postinstall, preinstall, install) behind an allowBuilds allowlist that defenders curate to limit which dependencies can run arbitrary code at install time. In versions prior to 10.34.2 and 11.5.3, the identity used to evaluate that allowlist was derived from manifest fields the package itself controls rather than the resolved registry identity. A crafted package — directly or via a transitive dependency — can present a manifest whose name matches an allowlisted entry, satisfy the gate, and execute attacker-controlled lifecycle scripts during pnpm install. CWE-346 (Origin Validation Error) captures the class precisely.

Vendor's HIGH (7.5) with AC:H and UI:R is defensible but slightly understates the real story. The 'high attack complexity' assumes the attacker still has to land a malicious package in the dependency graph — which the 2025–2026 npm supply-chain wave (Shai-Hulud, TanStack, lifecycle-token exfil) has shown is *not* a high bar. Once the package is in the graph, the allowBuilds bypass turns a 'we hardened install scripts' control into a paper one. We keep it at HIGH rather than upgrading to CRITICAL because the trigger still requires a developer or CI to run pnpm install against a contaminated lockfile, not a network-reachable service.

Why this verdict

• Friction audit — entry requires supply-chain landing: attacker must first publish a malicious package the victim resolves. This is no longer a high bar in 2026 (Shai-Hulud, TanStack), but it is still not internet-reachable on its own — supports HIGH, not CRITICAL.
• Friction audit — UI:R is real: pnpm install must be invoked. On CI this is automatic on every PR; on workstations it's frequent. Not a wormable network primitive.
• Friction audit — defense-in-depth bypass, not RCE primitive: the bug specifically defeats allowBuilds, a *hardening control*. Projects with ignore-scripts=true are unaffected; projects with no allowBuilds policy never benefited from the gate — narrowing the at-risk population to teams who deliberately tried to harden.
• Role multiplier — CI/CD build server (canonical high-value role): chain succeeds end-to-end. Blast radius: every secret in the CI environment, every artifact-registry publish token, every cloud OIDC role assumable from that runner. This is the supply-chain pivot pattern — verdict floor is HIGH.
• Role multiplier — developer workstation: chain succeeds. Blast radius: local SSH keys, gh tokens, AWS keys, browser sessions on macOS keychain. Worm potential via published packages from compromised maintainer credentials.
• Role multiplier — production runtime: rarely runs pnpm install in production. Limited.

Why not higher?

Not CRITICAL because there is no unauthenticated network trigger and no auto-execution without a developer or CI initiating pnpm install. EPSS is low and there is no published weaponized exploit chain naming this specific CVE. A CRITICAL bucket implies hours-to-days mass exploitation pressure; the evidence here is class-level not CVE-specific.

Why not lower?

Not MEDIUM because the bug defeats a hardening control specifically designed to stop the supply-chain class that *is* being mass-exploited in 2026. The role multiplier on CI runners (token egress, publish-back worm potential) holds the verdict floor at HIGH regardless of EPSS.

1. Set ignore-scripts=true globally in CI — Configure ~/.npmrc and project-level .npmrc with ignore-scripts=true on every CI runner. This bypasses the broken allowBuilds gate entirely by refusing to run *any* lifecycle script. Apply within the noisgate HIGH mitigation SLA — 30 days. For packages that legitimately need a build step (esbuild, sharp), pre-build artifacts in a sandboxed pipeline and consume the prebuilt tarballs.
2. Pin pnpm via Corepack and block drift — In package.json set "packageManager": "[email protected]" (or 10.34.2 for the LTS line) and enable Corepack in CI. Fail the build if the resolved pnpm version is below the fix. Deploy within 30 days alongside the upgrade rollout.
3. Enforce internal proxy registry with publisher allowlist — Verdaccio / Nexus / Artifactory in proxy-only mode, blocking shadowing of internal scopes by public packages, and requiring approval for any new transitive dependency publisher. Closes the upstream-landing precondition.
4. Scope CI tokens to short-lived OIDC — Replace long-lived NPM_TOKEN and PATs with OIDC federation (GitHub Actions → cloud, GitHub Actions → npm publish via trusted publishers). Reduces the value of any single install-time exfil.
5. EDR rules for node child processes — On dev workstations and CI runners, alert on node spawning sh, bash, cmd.exe, curl, wget, or reading ~/.aws/, ~/.ssh/, ~/.npmrc during an install window. CrowdStrike, SentinelOne, Wazuh all support this.

Run on every developer workstation and CI runner where pnpm is installed. Invoke as bash check-pnpm-cve-2026-55487.sh from any shell — no root required. Detects pnpm version, compares against the 10.34.2 / 11.5.3 fix lines, and flags whether ignore-scripts is set as a compensating control.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-55487 (pnpm manifest identity spoofing)
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

if ! command -v pnpm >/dev/null 2>&1; then
  echo "UNKNOWN: pnpm not on PATH"
  exit 2
fi

VER=$(pnpm --version 2>/dev/null | tr -d '[:space:]')
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not read pnpm --version"
  exit 2
fi

MAJOR=${VER%%.*}
REST=${VER#*.}
MINOR=${REST%%.*}
PATCH=${REST#*.}

ver_ge() {
  # ver_ge A.B.C X.Y.Z -> 0 if A.B.C >= X.Y.Z
  printf '%s\n%s\n' "$2" "$1" | sort -V -C
}

IGNORE_SCRIPTS=$(pnpm config get ignore-scripts 2>/dev/null | tr -d '[:space:]')

FIXED=1
case "$MAJOR" in
  10)
    if ver_ge "$VER" "10.34.2"; then FIXED=0; fi
    ;;
  11)
    if ver_ge "$VER" "11.5.3"; then FIXED=0; fi
    ;;
  *)
    if [ "$MAJOR" -gt 11 ] 2>/dev/null; then FIXED=0; fi
    ;;
esac

if [ "$FIXED" -eq 0 ]; then
  echo "PATCHED: pnpm $VER (ignore-scripts=$IGNORE_SCRIPTS)"
  exit 0
fi

if [ "$IGNORE_SCRIPTS" = "true" ]; then
  echo "VULNERABLE: pnpm $VER (mitigated by ignore-scripts=true, but upgrade still required)"
  exit 1
fi

echo "VULNERABLE: pnpm $VER (no fix, ignore-scripts not enforced)"
exit 1

Sources

1. GitHub Advisory Database
2. pnpm 11 release discussion
3. TanStack npm packages Shai-Hulud writeup (Snyk)
4. TanStack GHSA-g7cv-rxg3-hmpx
5. Microsoft — 33 malicious npm packages, dependency confusion
6. npm Supply Chain Security in 2026 (Mondoo)
7. pnpm CVE history (cvedetails)
8. npm manifest confusion class (CSO)