Executive brief
aegir is a build tool for JavaScript projects that publishes packages to npm. The tool may leak sensitive environment variables (API keys, tokens, credentials) into the published browser bundle, making these secrets visible to any user who downloads the package from npm.
Technical details
The vulnerability exists in aegir's publish and build commands, which fail to sanitize environment variables before bundling code for npm publication. The root cause is improper variable substitution or inlining of process.env values into the compiled browser bundle. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) issue. No authentication or user interaction is required to exploit this; an attacker simply downloads the affected package version and inspects the bundle for leaked credentials. The vulnerability affects versions 21.7.0 through 21.10.0 and has been patched in 21.10.1 and later.
Affected products
- IPFS aegir >=21.7.0, <21.10.1
Timeline
- 2020-05-22: disclosed
- 2020-05-27: patched: Version 21.10.1 released