An attack on NPM that allows the discovery of packages in private repositories
A vulnerability has been identified in NPM that allows for the detection of packages in private repositories. The issue is caused by the different response times when querying an existing package versus a non-existent one by an external user without access to the repository. For any packages in private repositories without access, the server registry.npmjs.org returns a '404' error, but in the case of an existing package with the requested name, an error is returned […]
