Executive brief
bin-links is a Node.js utility that manages symlinks for executable binaries installed via npm. Versions before 1.1.6 fail to prevent globally-installed binaries from being overwritten when new packages with conflicting binary names are installed, allowing a malicious or careless package to replace trusted tools on a system.
Technical details
The vulnerability is a file overwrite issue in the bin-links package prior to version 1.1.6. When packages are globally installed, the bin-links module creates symlinks or copies executables to the system's global node_modules binary directory without properly checking whether a binary with the same name already exists and is owned by a different package. An attacker or rogue package can exploit this to silently overwrite legitimate global binaries with malicious ones, leading to code execution under the user's privileges. Local (per-project) installations are not affected. The fix was released in version 1.1.6.
Affected products
- npm bin-links < 1.1.6
Timeline
- 2020-09-04: disclosed
- 2020-09-04: patched: Fixed in version 1.1.6