npm Blog Archive: Binary Planting with the npm CLI

The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. tl;dr - Update to npm v6.13.4 as soon as possible on all your systems to fix a vulnerability allowing arbitrary path access. The Vulnerabilities In versions of npm prior to 6.13.3 (and versions of yarn prior to 1.21.1), a properly constructed entry in the package.json bin fi

[efcl]

npm 6.13.3以下とyarn 1.12.0以下で、 悪意あるパッケージをインストールするとシステムのコマンドを書き換えできる脆弱性があった。 npm 6.13.4、yarn 1.12.1でそれぞれ修正されている

[teppeis]

インストールスクリプトで元々何でもできちゃうから、実質は--ignore-scriptしているケースでの問題か

[gfx]

"Update to npm v6.13.4 as soon as possible on all your systems to fix a vulnerability allowing arbitrary path access"