# CVE-2019-16777: npm global node_modules binary overwrite

Source: https://junglewise.ai/threats/cve-2019-16777-npm-global-node-modules-binary-overwrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-16777 · Severity: low · CVSS 3.1 · Published 2019-12-13

npm is a package manager used by millions of developers to install and manage JavaScript libraries. Versions prior to 6.13.4 fail to prevent globally-installed command-line binaries from being overwritten when other packages create files with the same name. An attacker could craft a malicious package that, when installed globally, overwrites legitimate binaries already in use—potentially allowing code execution if a user runs the compromised binary.

Technologies: [npm (npm)](https://junglewise.ai/threats/technologies/npm). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-16777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16777 being exploited in the wild.

**How severe is CVE-2019-16777?** Low severity, with a CVSS score of 3.1, published 13 December 2019.

**Which products and versions are affected?** npm (npm) <6.13.4.

**Is there a fix for CVE-2019-16777?** A patch was published on 2019-12-13: npm 6.13.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-16777 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-16777?** Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a path traversal/binary planting issue (CWE-22, CWE-269) in npm's installation logic. When installing packages globally, npm does not adequately verify or protect existing binaries already present in the global node_modules bin directory. An attacker can craft a malicious package with a bin field that references an existing binary name, and upon installation, overwrite the legitimate binary with malicious code. The vulnerability requires user interaction (the victim must install a malicious package) and affects only global installations via direct npm install commands; it bypasses the --ignore-scripts flag and persists even when users attempt to avoid running install scripts. The fix is to upgrade npm to version 6.13.4 or later, which implements proper permission checks and protection for existing binaries.

## Affected products

- npm npm <6.13.4

## Identifiers

- CVE-2019-16777
- GHSA-4328-8hgf-7wjr

## Timeline

- 2019-12-13: disclosed
- 2019-12-13: patched: npm 6.13.4 released

## References

- [https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr](https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr)
- [https://access.redhat.com/errata/RHEA-2020:0330](https://access.redhat.com/errata/RHEA-2020:0330)
- [https://access.redhat.com/errata/RHSA-2020:0573](https://access.redhat.com/errata/RHSA-2020:0573)
- [https://access.redhat.com/errata/RHSA-2020:0579](https://access.redhat.com/errata/RHSA-2020:0579)
- [https://access.redhat.com/errata/RHSA-2020:0597](https://access.redhat.com/errata/RHSA-2020:0597)
- [https://access.redhat.com/errata/RHSA-2020:0602](https://access.redhat.com/errata/RHSA-2020:0602)

## Related threats

- [npm cli local privilege escalation via uncontrolled module search path](https://junglewise.ai/threats/cve-2026-0775-npm-cli-local-privilege-escalation-via-uncontrolled-module-search)
- [npm pack root-level ignore file bypass in workspaces](https://junglewise.ai/threats/cve-2022-29244-npm-pack-root-level-ignore-file-bypass-in-workspaces)
- [npm incorrect permission assignment in mkdir](https://junglewise.ai/threats/cve-2018-7408-npm-incorrect-permission-assignment-in-mkdir)
- [npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems)
- [npm public path traversal via symlink navigation](https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29)