pnpm

Fast, disk space efficient package manager

Latest 12.11.2

NPM

96%

Total Score

healthy

Frequent releases, active repository work, and verified npm provenance indicate a mature, well-maintained release.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

The package declares both preinstall and postinstall scripts, which increase install-time behavior and deserve review, although this is consistent with a package manager distribution that installs platform-specific executables.

Workflow audit

All 29 workflows were analyzed with no failed files, no untrusted checkouts, no script injection, and all 263 action references pinned. The single high-confidence low-severity adhoc-packages finding concerns an install outside a lockfile, so it is a minor hygiene concern.

Vulnerabilities

Title	Versions	Severity
CVE-2026-82392 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.5 and 11.0.0 - 11.11.0.	0.0.0 - 10.34.511.0.0 - 11.11.0	High
CVE-2026-82393 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.5 and 11.0.0 - 11.11.0.	0.0.0 - 10.34.511.0.0 - 11.11.0	High
AIKIDO-2026-789279 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. pnpm is vulnerable to Path Traversal in versions 6.25.0 - 10.34.4 and 11.0.0 - 11.10.0.	6.25.0 - 10.34.411.0.0 - 11.10.0	High
CVE-2026-50015 pnpm is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 10.34.0 and 11.0.0 - 11.4.0.	0.0.0 - 10.34.011.0.0 - 11.4.0	High
CVE-2026-50016 pnpm is vulnerable to Relative Path Traversal in versions 0.0.0 - 10.34.0 and 11.0.0 - 11.4.0.	0.0.0 - 10.34.011.0.0 - 11.4.0	High