SECURITYWEEK reports that six vulnerabilities across NPM, PNPM, VLT and Bun could bypass protections designed to stop automatic code execution during package installation, opening JavaScript supply chains to remote code execution. Following high-profile attacks such as Shai-Hulud and PhantomRaven, two defence mechanisms—ignoring preinstall/install/postinstall scripts and recording package versions with integrity hashes—could be bypassed by attacker-controlled dependencies.
For each manager the technique differs, with NPM vulnerable via a malicious .npmrc in a Git dependency, PNPM revealing build-phase script protections were incomplete for Git dependencies, and VLT exposing a tarball path-traversal that allows arbitrary file writes. Bun’s allow-list protection only covered package names, not their sources, enabling spoofed packages for RCE.
PNPM fixes are tracked as CVE-2025-69263 and CVE-2025-69264, and PNPM, VLT and Bun addressed the flaws within weeks, while NPM reportedly closed their report as informational. According to Koi, the risk remains real and threat actors have discussed PoC code abusing malicious .npmrc files. Written by Ionut Arghire.