CodeVetter · Repo Unpack · Risk map
pnpm/pnpm
The observations below identify trust boundaries and behavior that deserves careful review; they are not confirmed vulnerabilities. Package scripts and JavaScript hooks intentionally cross into process execution, while pnpr handles identity, remote fetches, cached private data, and persistent publication state. Several protections are explicit, including early authorization, integrity-gated cache promotion, connection policy, and verification gates. Operational assumptions and coverage limits remain relevant even when those protections are present.
- The executor exposes shell execution through sh -c and allows callers to choose the working directory; command strings therefore cross an intentional code-execution boundary, and nonzero child status is distinct from spawn/wait errors.
- pnpmfile hooks execute JavaScript in Node processes. readPackage/afterAllResolved/filterLog use a lazy long-lived worker, while preResolution uses node -e with piped JSON and a 30-second timeout; preResolution failures warn rather than abort.
- Lockfile verification can overlap resolution/fetching but must gate sensitive downstream operations. The gate aborts on drop; trustLockfile or an empty verifier set makes verification a no-op, so changes to either policy or completion ordering require review.
- pnpr mounts authentication before handlers to enforce token restrictions before buffering large write bodies. Unknown or revoked ordinary bearer tokens can resolve to anonymous, leaving route and per-package policy responsible for distinguishing public access from protected operations.
- Resolver connection policy admits public addresses, explicitly allowed private networks, and the server's configured public_url host. IP literals are checked separately from hostname resolution; own-host configuration and private-network exceptions are security-sensitive inputs.
- A warm upstream tarball cache hit without OSV intentionally skips re-binding against current metadata, so previously verified bytes can remain downloadable after a version is unpublished. The documented acceptance authority is the client's lockfile integrity.
- Inference: install completion is a broad regression hotspot because filtered selection, prior metadata, current lockfiles, and workspace freshness meet at separate writes; reordering freshness ahead of module/current-lockfile commit could advertise an incomplete tree. (inferred)
- The inspected CodeQL workflow selects only JavaScript, and the smoke profile explicitly limits its correctness claim. Neither source establishes Rust security-analysis coverage or full branch coverage; broader repository tooling was not exhaustively audited.