Executive brief
esbuild is a JavaScript bundler with Deno module support that downloads native binaries from npm registries during installation. A missing integrity check in the Deno variant allows attackers who control the NPM_CONFIG_REGISTRY environment variable to supply malicious binaries that execute with the privileges of the Deno process, achieving complete code execution. This is particularly dangerous in CI/CD pipelines and shared development environments where registry configuration is often centralized.
Technical details
The esbuild Deno module (lib/deno/mod.ts) fetches native binary executables from an npm registry specified by the NPM_CONFIG_REGISTRY environment variable without performing SHA-256 integrity verification. The Node.js equivalent (lib/npm/node-install.ts) includes a binaryIntegrityCheck() function that validates downloaded binaries against hardcoded hashes in package.json, but this protection was never implemented for Deno. An attacker controlling the NPM_CONFIG_REGISTRY variable can redirect downloads to a malicious server and serve trojaned binaries that are written to disk with executable permissions (0o755) and subsequently executed by the Deno process. The vulnerability affects versions >=0.17.0 and was patched in >=0.28.1. No user interaction or prior authentication is required; the attack vector is network-accessible and depends only on environment variable manipulation, which is common in enterprise CI/CD systems.
Affected products
- evanw esbuild >=0.17.0
Timeline
- 2026-06-11: disclosed
- 2026-06-28: patched: Fixed in version 0.28.1