mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-17 19:22:20 -04:00
455cfcd84b
A transitive registry package can use a dependency-alias key like `@x/../../../../../.git/hooks` to make `pnpm install` create a symlink outside the intended `node_modules` directory, since pnpm passes the alias straight into `path.join(modulesDir, alias)` without checking that the joined path stays inside `modulesDir`. Reject aliases that aren't valid npm package names at manifest-read time (both the importer's manifest and every transitive package manifest) and re-check at the symlink layer as defense in depth. Backport of #11954 to the release/10 line. --- Written by an agent (Claude Code, claude-opus-4-7).