PNPM versions before 11.11.0 and 10.34.5 incorrectly expand environment-variable placeholders in httpProxy, httpsProxy, and noProxy fields read from a project’s pnpm-workspace.yaml. An attacker can embed secrets such as NPM_TOKEN or GITHUB_TOKEN into these fields, causing the values to be resolved by the client during configuration loading. This causes the fabricated proxy hostname or userinfo to be used for all subsequent traffic, exposing the secret values in DNS queries and HTTP requests before any install scripts run. The vulnerability allows a malicious repository to exfiltrate sensitive credentials from a victim’s environment simply by having them install the project.

Vulnerable systems are those running PNPM version 11.0.0 through 11.10.9 and 10.7.0 through 10.34.4. The issue manifests in any environment where an attacker controls the repository’s pnpm-workspace.yaml, which can be hosted on public code hosting platforms or internal Git repositories.

The CVSS score of 8.3 indicates high severity, and the issue is not listed in KEV and has no EPSS score available. The likely attack vector is a malicious or compromised repository containing crafted placeholder values. An attacker only needs to get the victim to clone and run a PNPM command such as pnpm install. Once the configuration is loaded, contextual secrets are leaked to a server controlled by the attacker, exposing credentials and potentially enabling further compromise. The vulnerability can be exploited without privilege escalation and before any lifecycle script runs, making it especially dangerous.