pnpm

Fast, disk space efficient package manager

Latest 12.14.0

NPM

94%

Total Score

healthy

Long-running releases, active organization-backed development, and verified publishing make this a healthy release.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

The package uses preinstall and postinstall scripts, which expand install-time behavior and deserve awareness for a package manager, although this signal alone does not establish a health failure.

Workflow audit

All 29 workflows were analyzed successfully, all 265 action references are pinned, and no untrusted checkout or script-injection paths were found. One high-confidence low-severity finding reports an ad hoc package installation in the release workflow, so workflow hygiene is not perfect.

Vulnerabilities

Title	Versions	Severity
CVE-2026-82392 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.5 and 11.0.0 - 11.11.0.	0.0.0 - 10.34.511.0.0 - 11.11.0	High
CVE-2026-82393 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.5 and 11.0.0 - 11.11.0.	0.0.0 - 10.34.511.0.0 - 11.11.0	High
AIKIDO-2026-789279 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. pnpm is vulnerable to Path Traversal in versions 6.25.0 - 10.34.4 and 11.0.0 - 11.10.0.	6.25.0 - 10.34.411.0.0 - 11.10.0	High
CVE-2026-50015 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.0 and 11.0.0 - 11.4.0.	0.0.0 - 10.34.011.0.0 - 11.4.0	High
CVE-2026-50016 pnpm is vulnerable to Relative Path Traversal in versions 0.0.0 - 10.34.0 and 11.0.0 - 11.4.0.	0.0.0 - 10.34.011.0.0 - 11.4.0	High