Junglewise Threat Intelligence

CVE-2019-16777: npm global node_modules binary overwrite

CVE-2019-16777 · Severity: low · CVSS 3.1 · Published 2019-12-13

Technologies: npm (npm). Vendors: npm.

Executive brief

npm is a package manager used by millions of developers to install and manage JavaScript libraries. Versions prior to 6.13.4 fail to prevent globally-installed command-line binaries from being overwritten when other packages create files with the same name. An attacker could craft a malicious package that, when installed globally, overwrites legitimate binaries already in use—potentially allowing code execution if a user runs the compromised binary.

Technical details

This vulnerability is a path traversal/binary planting issue (CWE-22, CWE-269) in npm's installation logic. When installing packages globally, npm does not adequately verify or protect existing binaries already present in the global node_modules bin directory. An attacker can craft a malicious package with a bin field that references an existing binary name, and upon installation, overwrite the legitimate binary with malicious code. The vulnerability requires user interaction (the victim must install a malicious package) and affects only global installations via direct npm install commands; it bypasses the --ignore-scripts flag and persists even when users attempt to avoid running install scripts. The fix is to upgrade npm to version 6.13.4 or later, which implements proper permission checks and protection for existing binaries.

Affected products

  • npm npm <6.13.4

Timeline

  • 2019-12-13: disclosed
  • 2019-12-13: patched: npm 6.13.4 released

References

Related threats