Executive brief
The npm package manager (versions prior to 6.13.3) allows a malicious package to create files or symlinks outside the intended installation directory when a user installs the package. A package publisher could exploit this to write files to arbitrary locations on a developer's system with the permissions of the user running npm install, potentially compromising the system or enabling further attacks.
Technical details
This vulnerability exists in the bin field processing of package.json, where npm fails to properly validate paths and prevent directory traversal. An attacker can craft a malicious package.json with specially constructed bin field entries that reference paths outside the node_modules directory, allowing creation of arbitrary files or symlinks. The vulnerability is network-reachable through package installation but requires a user to actively install the malicious package. The fix is available in npm CLI version 6.13.3 and later. Notably, this vulnerability can bypass the --ignore-scripts install option, making it particularly dangerous.
Affected products
- npm npm <6.13.3
Timeline
- 2019-12-12: disclosed
- 2019-12-13: patched: Version 6.13.3 released
- 2019-12-13: advisory