Executive brief
The npm CLI package manager inadvertently logs unredacted authentication credentials when processing registry URLs containing embedded passwords. An attacker with local access to log files could extract these credentials and gain unauthorized access to private npm packages or registries, potentially compromising supply chain security and sensitive development resources.
Technical details
The vulnerability is an information exposure flaw (CWE-532) in npm CLI versions prior to 6.14.6. The CLI fails to redact password values from URLs matching the pattern <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. Credentials are exposed both to stdout and in log files generated by the tool. Attack requires local file system access to read generated logs. An attacker can retrieve plaintext authentication credentials and use them for unauthorized package registry access. The vulnerability was patched in version 6.14.6.
Affected products
- npm npm prior to 6.14.6
Timeline
- 2020-07-07: disclosed
- 2020-07-07: patched: version 6.14.6 released