Executive brief
Yarn is a package manager used by developers to manage JavaScript dependencies. Before version 1.17.3, Yarn could store HTTP URLs in its lockfile that cause authentication credentials to be transmitted unencrypted over the network, potentially exposing them to interception and compromise.
Technical details
This vulnerability stems from Yarn's use of HTTP (unencrypted) URLs in lockfiles, which causes authentication tokens and credentials to be sent in plaintext over the network. The vulnerability affects all versions before 1.17.3. An attacker positioned to intercept network traffic (e.g., on a shared network or via a compromised router) can capture these unencrypted authentication credentials. The fix involves using HTTPS URLs or other secure mechanisms to prevent credential exposure. The issue was publicly disclosed and patched in Yarn 1.17.3.
Affected products
- Yarn Yarn before 1.17.3
Timeline
- 2019-07-31: disclosed
- 2019-07-12: patched: Security update released