{"id":105307,"date":"2022-10-14T15:36:38","date_gmt":"2022-10-14T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah"},"modified":"2022-10-14T15:36:38","modified_gmt":"2022-10-14T13:36:38","slug":"ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","title":{"rendered":"An attack on NPM that allows the discovery of packages in private repositories","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been detected in NPM that allows the existence of packages in private repositories to be determined. The issue arises due to different response times when querying an existing versus a non-existing package by an external user without access to the repository. When access is denied for any packages in private repositories, the server registry.npmjs.org returns a «404» error, but if a package with the requested name exists, the error is returned with a noticeable delay. An attacker can exploit this feature to ascertain the presence of a package by guessing names using dictionaries. <\/p>\n
Determining package names in private repositories may be necessary for conducting a dependency confusion attack that manipulates the overlap of dependency names in public and internal repositories. By knowing which internal NPM packages are present in corporate repositories, an attacker can publish packages with the same names and newer version numbers in the public NPM repository. If internal libraries are not explicitly bound in the configuration to their repository during the build, the npm package manager will consider the public repository more prioritized and download the package prepared by the attacker. <\/p>\n
GitHub was notified of the issue in March but declined to add protection against the attack, citing architectural limitations. Companies using private repositories are advised to periodically check for overlapping names in the public repository or to create stubs under their name that replicate the names of packages in private repositories, so that malicious actors cannot publish their packages with overlapping names. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"