# bin-links global binary overwrite vulnerability

Source: https://junglewise.ai/threats/bin-links-global-binary-overwrite-vulnerability-0f0acfd6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-09-04

bin-links is a Node.js utility that manages symlinks for executable binaries installed via npm. Versions before 1.1.6 fail to prevent globally-installed binaries from being overwritten when new packages with conflicting binary names are installed, allowing a malicious or careless package to replace trusted tools on a system.

Technologies: [bin-links (npm)](https://junglewise.ai/threats/technologies/bin-links). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 4 September 2020.

**Which products and versions are affected?** bin-links (npm) < 1.1.6.

**Is there a fix for This vulnerability?** A patch was published on 2020-09-04: Fixed in version 1.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run bin-links (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a file overwrite issue in the bin-links package prior to version 1.1.6. When packages are globally installed, the bin-links module creates symlinks or copies executables to the system's global node_modules binary directory without properly checking whether a binary with the same name already exists and is owned by a different package. An attacker or rogue package can exploit this to silently overwrite legitimate global binaries with malicious ones, leading to code execution under the user's privileges. Local (per-project) installations are not affected. The fix was released in version 1.1.6.

## Affected products

- npm bin-links < 1.1.6

## Timeline

- 2020-09-04: disclosed
- 2020-09-04: patched: Fixed in version 1.1.6

## References

- [https://www.npmjs.com/advisories/1438](https://www.npmjs.com/advisories/1438)

## Related threats

- [npm bin-links arbitrary symlink creation via bin field](https://junglewise.ai/threats/npm-bin-links-arbitrary-symlink-creation-via-bin-field-a4a37c45)
- [bin-links arbitrary file write via bin field](https://junglewise.ai/threats/bin-links-arbitrary-file-write-via-bin-field-c477870a)