ProHoster > Blog > Internet News > A vulnerability in NPM allows modification of arbitrary files when installing a package
A vulnerability in NPM allows modification of arbitrary files when installing a package
In the update of the NPM package manager 6.13.4, included with Node.js and used for distributing JavaScript modules, (, and ), which allows modifying or overwriting arbitrary system files during the installation of a package prepared by an attacker. A workaround for protection could be to install with the "--ignore-scripts" option, which prohibits executing built-in package handlers. NPM developers analyzed the packages available in the repository and found no traces of using the identified issues for attacks.
CVE-2019-16777 in versions prior to 6.13.4 and allows overwriting system executable files during the global installation of a package. Only files in the target directory where executable files are installed (usually /usr/local/bin) can be substituted.
and manifest in versions prior to 6.13.3 and allow writing arbitrary files by creating symbolic links to files outside the module directory (node_modules) or through manipulation of the bin field in package.json (the bin field allowed the use of paths containing "/../").
