The vulnerability is a fail‑open integrity verification bypass (CWE‑494: Use of Trusted Data) and also involves improper handling of missing integrity information (CWE‑354). It allows an attacker who can modify the pnpm-lock.yaml file and control the registry URL referenced by the lockfile to bypass integrity verification and install altered packages. Because the integrity field is optional in older pnpm releases, the updated package is extracted and executed without any error, enabling the attacker to compromise the dependency chain or inject malicious code. The flaw directly threatens the integrity of the software supply chain.

Affected systems include environments running pnpm versions earlier than 10.34.0 or 11.4.0. The vendor pnpm and its package manager are the only affected components. Systems using pnpm for dependency resolution and committing to lockfile without integrity checks are at risk.

The severity is reflected in a CVSS score of 6.8, indicating moderate risk. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to tamper with the pnpm-lock.yaml file and supply a malicious package from a registry endpoint that matches the lockfile entry, then run pnpm install --frozen-lockfile. The likely attack vector involves compromised or malicious repositories that supply altered tarballs, or locally compromising the lockfile on an installation machine.