A security issue has been identified in the NPM package repository that allows the package owner to add any user as a maintainer without obtaining consent from that user and without informing them of the action taken. The problem is exacerbated by the fact that after adding a third-party user as a maintainer, the original author of the package could remove themselves from the maintainer list, leaving the third-party user as the sole individual responsible for the package.
Malicious package creators could exploit this issue to add well-known developers or large companies as maintainers to enhance user trust and create the illusion that reputable developers are responsible for the package, even though they have no connection to it and may not even be aware of its existence. For instance, an attacker could publish a malicious package, change the maintainer, and invite users to test a new development from a large company. The vulnerability could also be used to tarnish the reputation of certain developers by presenting them as instigators of dubious actions and malicious activities.
GitHub was notified of the issue on February 10 and resolved it on April 26 through npmjs.com by implementing mandatory confirmation from users agreeing to join another project. Developers of a large number of NPM packages are advised to check whether any packages belonging to them have been linked without their consent.
Source: opennet.ru
