Benign Download

minimal-x86-64/nixos-minimal-25.05.813814.ac62194c3917-x86_64-linux/nix-store.squashfs.d/crs1ks6b3513ymkmxn8g4iivxz95gvkf-nixos-25.05.813814.ac62194c3917/nixos/pkgs/development/tools/pnpm/fetch-deps

Reports a downloaded digest mismatchpnpm package install command

SHA-2561e47987c0d4d8039e45be3bd2be92e15c18eb685b455f2270db09ff8640207de

Evidence

chmod shell command lines 25–37

25:14… ORE_PATH=$(mktemp -d)
26
27    cp -Tr "$pnpmDeps" "$STORE_PATH"
28    chmod -R +w "$STORE_PATH"
29
30
31    # If the packageManager field in package.json is set to a different pnpm version than what is in nixpkgs,
32    # any pnpm command would fail in that directory, the following disables this
33    pushd ..
34    pnpm config set manage-package-manager-versions false
35    popd
36
37    pnpm confi …

pnpm package install command lines 49–64

23… kspaces" ]]; then
      local IFS=" "
      for ws in $pnpmWorkspaces; do
          pnpmInstallFlags+=("--filter=$ws")
      done
  fi
55
  runHook prePnpmInstall
57
  if ! pnpm install \
      --offline \
      --ignore-scripts \
⋯4 lines

Reports a downloaded digest mismatch lines 68–77

48…  string)'
      echo "2. Build the derivation and wait for it to fail with a hash mismatch"
      echo "3. Copy the 'got: sha256-' value back into the pnpmDeps.hash field"
      echo
⋯6 lines