Executive brief
lockfile-lint-api is a tool used to validate npm package lock files for security issues. A flaw in its package name validation allows attackers to bypass intended restrictions by extending the package name, potentially tricking developers into installing malicious npm packages instead of the ones they intended.
Technical details
The vulnerability is an incorrect behavior order (CWE-179) in the resolved attribute validation of the package URL validation logic. The issue exists in the ValidatePackageNames.js validator where a missing trailing slash in the regex pattern allows attackers to bypass the package name validation by extending the package name. For example, a package like "lodash/" could be manipulated to bypass checks intended to ensure only whitelisted packages are installed. This is a validation bypass that requires no authentication and is exploitable over the network. The vulnerability affects versions before 5.9.2, which was patched by adding the missing trailing slash to the validation regex.
Affected products
- npm lockfile-lint-api before 5.9.2
Timeline
- 2025-05-16: disclosed: GHSA-7cfr-5cjf-32p4 published
- 2025-04-27: patched: Fix merged in pull request #204