p​npm does not record the hash of tarball dependencies retrieved from codeload.github.com in its lockfile. When the server that serves those tarballs is compromised or a user’s network path is manipulated, pnpm will download and install an arbitrary tarball without verifying its integrity. This flaw, a variant of insecure dependency verification (CWE‑494), can lead to the execution of malicious code during the installation of project dependencies, thereby compromising both confidentiality and integrity of the affected application.

pnpm versions older than 10.33.4 in the 10.x series and older than 11.0.7 in the 11.x series. Projects that depend on GitHub tarballs accessed via codeload.github.com are affected.

The CVSS score of 4.8 classifies this issue as medium severity, while the EPSS score of <1% indicates a very low but nonzero chance of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to control the codeload.github.com service or to tamper with the user’s network path (e.g., via a man‑in‑the‑middle attack). Given the potential for arbitrary code execution at install time, the risk is moderate, but exploitation probability remains low.