pnpm, uv, and rustup Patch Script Rules and Compromised Roots

A series of coordinated security updates rolled out across development tooling highlights how fragile local trust boundaries remain in the software supply chain. Across the ecosystem, package managers have spent recent days fixing how they validate registry responses, manage root certificates, and inspect incoming dependencies.

On October 21, pnpm released versions 12.15 and 11.28.7 to fix a bypass in its script execution rules. Previously, if an npm registry returned metadata pointing to a package name different from what was requested, pnpm installed it under the registry's reported name. That behavior allowed packages to sidestep local allowBuilds policies, which define whether build scripts are permitted to execute on a developer's machine. Under the new releases, any discrepancy triggers an immediate ERR_PNPM_REGISTRY_NAME_MISMATCH abort. Both releases also introduced a default 4 GiB unpacked size cap (maxTarballUnpackedSize) to prevent decompression bombs.

Meanwhile, the fallout from compromised intermediate certificates at eMudhra forced certificate updates in tools that maintain their own trust stores. Because utilities like uv, Hex, and rustup do not purely rely on host operating system roots for secure connections, they must update their embedded bundles manually to guard against man-in-the-middle attacks. On October 20, uv 0.13.4 removed emSign ECC Root CA - G3, Hex 2.5.4 dropped trust in three emSign roots, and rustup 1.29.2 patched its certificate-handling dependencies. Developers pointing uv to system roots via --system-certs or environment variables still need to verify their underlying host stores have purged the revoked authority.

To intercept malicious or altered packages earlier, GitHub also entered public preview on October 20 with a package firewall for GitHub Enterprise Cloud. Operating as an intermediary proxy between environments and the npm registry, the tool allows administrators to enforce quarantine delays, verify provenance changes, and block known vulnerabilities from the GitHub Advisory Database. However, the mechanism relies entirely on configuration discipline: it only inspects traffic explicitly routed through the proxy, leaving any workstation or runner pointed directly at public registries untouched.

Source: habr