pnpm: Repository config can expand victim environment secrets into registry requests before scripts run (CVE-2026-55180) | HOL Guard CVE