pnpm/npm Environment Key Leakage via .npmrc Expansion (CAND-PNPM-122)

Vulnerability Overview CAND-PNPM-122: Repository configuration can leak victim environment keys into registry requests Vulnerability Description: pnpm and npm expanded placeholders in repository-controlled and files, leading to the leakage of registry request destinations and keys within registry credentials. Impact: Malicious repositories can send victim environment keys to a registry chosen by the attacker before script execution, potentially leaking sensitive information during dependency resolution. Scope of Impact Affected Versions: - pnpm: =10.34.2 and =11.5.3 Remediation Plan Maintainer Action Plan: - Review the shared patch branch using PRs and expected behavior, then replace original paths with detailed explanatory narratives. - Patch branch: - Patch commit: - Base commit: - Maintainer priority: start-here - Components: and - Patch areas: and - Affected packages: , , , - CVE IDs: CWE-201, CWE-200, CWE-522 - Initial CVSS: 8.5 / CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Next steps: Review the shared patch branch, set final affected version range, merge and publish the fix, then publish or close the advisory. Expected Patch Behavior Project environment placeholders: Do not expand for registry or authentication destinations; keys are not included in request URLs and authentication headers. File and Test Review Configuration files: - - - - - - - - - Focus Validation Commands: Proof of Concept (PoC) Repository URL leak: Repository Auth header leak: Repository URL leak: Exploitation Method 1. The victim checks out the repository and runs pnpm or npm dependency management commands using or other sensitive environment variables. 2. Before the patch, the repository configuration expands placeholders to the victim's keys. 3. The parser builds metadata requests using the expanded registry or matching authentication headers. 4. The victim sends requests, such as or , to the attacker-controlled endpoint. PoC Verification PoC Model: Pre-patch URL and authorization header leaks are demonstrated; post-patch verification confirms that pnpm and npm do not retain keys in repository-controlled registry destinations or credential values. Impact Severity: High Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Score: 7.4 Post-patch Severity: None Vector String: None Score: 0.0 Weaknesses CWE-201: Insertion of sensitive information into sent data CWE-200: Exposure of sensitive information to unauthorized parties CWE-522: Insufficient protection of credentials Patch Details Patch Content: - Project no longer expands within registry, , proxy URL values, URL-scoped keys like , registry credential values like and . - User , , global, and environment configurations still support env expansion for trusted registry configurations. - no longer expands within registry, , or URL values. - Trusted user-level credential values like remain or are lost as before, preserving setup steps and OIDC trusted publishing behavior where is provided as user configuration. - Pacote mirrors the same boundary with for project and workspace registry filtering. Verification PoC Execution: Results: - Pre-patch PoC model shows in request URLs and bearer authentication headers. - TypeScript build for pnpm: Passed. - Focus non-manifest tests: Passed, including workspace registry and named registry placeholder rejection. - Focus code coverage integration tests: Passed, covering project : default registry rejection, scoped registry rejection, URL scoped key rejection, project credential rejection, trusted user registry expansion, trusted user credential expansion/loss fallback, workspace registry rejection. - : Passed. - Focus Pacote tests: Passed, covering project : registry rejection, scoped registry rejection, URL scoped key rejection, authentication rejection, trusted user : registry expansion, workspace YAML rejection. - : Passed. CVSS Re-evaluation Initial Scan: Used repository code execution vector. CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (8.0 High) PoC and Source Code Trace: Showed that this finding involves direct disclosure of keys via registry request URLs or authorization headers, not a code execution path. Corrected Vulnerability Vector: - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (7.4 High) Final Post-patch Score: 0.0

Goal Reached Thanks to every supporter — we hit 100%!

pnpm/npm Environment Key Leakage via .npmrc Expansion (CAND-PNPM-122)

More from this source