AIKIDO-2026-789279

TL;DR

During pnpm install, the isolated (virtual-store) linker, the Plug'n'Play resolver map, and the global-virtual-store slot builder construct filesystem paths from lockfile-controlled dependency names/aliases and from a dependency's own manifest name and version without validating them for path traversal. A crafted pnpm-lock.yaml entry, or a malicious dependency whose manifest name, alias, or snapshot version contains ../ sequences, can make the installer write package content, symlinks, or bins outside node_modules and the virtual store, even with --ignore-scripts or --frozen-lockfile --trust-lockfile. This lets a malicious dependency overwrite existing files such as shell startup files or git hooks, leading to code execution when the victim later runs a normal command. The fix routes these names through containment guards (safeJoinModulesDir and an unconditional lockfile dependency-name check) and rejects traversal names, aliases, and version segments with ERR_PNPM_INVALID_DEPENDENCY_NAME.