pnpm
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION] (HIGH): The skill documents the use of '.pnpmfile.cjs' hooks and lifecycle scripts in 'package.json'. An agent reading these from an untrusted repository could be induced to execute malicious JavaScript or shell commands during the installation process.
- [COMMAND_EXECUTION] (HIGH): The 'pnpm dlx' and 'pnpm run' commands allow for the execution of arbitrary code from the registry or local scripts. Using these on attacker-controlled inputs/projects facilitates Remote Code Execution.
- [DATA_EXFILTRATION] (MEDIUM): The skill guides agents to interact with '.npmrc' files which commonly store sensitive authentication tokens (e.g., '_authToken'). Malicious project files could attempt to trick the agent into leaking these credentials.
Recommendations
- AI detected serious security threats
Audit Metadata