<story><title>Security issue related to the NPM registry</title><url>https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/#security-issues-related-to-the-npm-registry</url></story><parent_chain><item><author>nfm</author><text>Because this is buried in the post and people don&amp;#x27;t seem to be grokking it:&lt;p&gt;&amp;gt; Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.&lt;p&gt;They correctly authenticated the attacker and checked they were authorised to upload a new version of &lt;i&gt;their own&lt;/i&gt; package, but a malicious payload allowed the attacker to then upload a new version of a completely unrelated package that they weren&amp;#x27;t authorised for. Ouch!</text></item></parent_chain><comment><author>jschrf</author><text>&amp;gt; However, the service that performs underlying updates to the registry data determined which package to publish based on the contents of the uploaded package file&lt;p&gt;Yeah, this is what&amp;#x27;s going to keep me up tonight. Yikes.&lt;p&gt;I can&amp;#x27;t help but wonder if the root cause was HTTP request smuggling, or if changing package.json was enough.&lt;p&gt;How do we even mitigate against these types of supply-chain attacks, aside from disabling run-scripts, using lockfiles and carefully auditing the entire dependency tree on every module update?&lt;p&gt;I&amp;#x27;m seriously considering moving to a workflow of installing dependencies in containers or VMs, auditing them there, and then perhaps commiting known safe snapshots of node_modules into my repos (YUCK). Horrible developer experience, but at least it&amp;#x27;ll help me sleep at night.</text></comment>
<story><title>Security issue related to the NPM registry</title><url>https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/#security-issues-related-to-the-npm-registry</url></story><parent_chain><item><author>nfm</author><text>Because this is buried in the post and people don&amp;#x27;t seem to be grokking it:&lt;p&gt;&amp;gt; Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.&lt;p&gt;They correctly authenticated the attacker and checked they were authorised to upload a new version of &lt;i&gt;their own&lt;/i&gt; package, but a malicious payload allowed the attacker to then upload a new version of a completely unrelated package that they weren&amp;#x27;t authorised for. Ouch!</text></item></parent_chain><comment><author>ptx</author><text>Also: &amp;quot;This vulnerability existed in the npm registry beyond the timeframe for which we have telemetry to determine whether it has ever been exploited maliciously.&amp;quot;</text></comment>