NPM fixes private package names leak, serious authorization bug

guest · Nov 16, 2021

NPM fixes private package names leak, serious authorization bug
November 16, 2021
https://www.bleepingcomputer.com/ne...package-names-leak-serious-authorization-bug/

The largest software registry of Node.js packages, npm, has disclosed multiple security flaws that were identified and remedied recently.

The first flaw concerns leak of names of private npm packages on the npmjs.com's 'replica' server—feeds from which are consumed by third-party services.
Whereas, the second flaw allows attackers to publish new versions of any existing npm package that they do not own or have rights to, due to improper authorization checks.
Click to expand...

Private npm package names leaked
This week, npm's parent company, GitHub has disclosed two security flaws that were identified and resolved in the npm registry between October and this month.

The first one is a data leak on the npmjs' replication server, which was caused by 'routine maintenance.' The leak exposed a list of names of private npm packages, but not the content of these packages during the maintenance window.

"During maintenance on the database that powers the public npm replica at replicate.npmjs.com, records were created that could expose the names of private packages," states GitHub Chief Security Officer, Mike Hanley in a blog post.
Click to expand...

Flaw could let unauthorized publication of new versions
Additionally, GitHub disclosed a serious bug that could "allow an attacker to publish new versions of any npm package using an account without proper authorization."

This vulnerability stemmed from improper authorization checks and data validation in between several microservices that process requests to the npm registry.
Click to expand...

GitHub: GitHub’s commitment to npm ecosystem security

The npm registry is central to all JavaScript development, and, as stewards of the registry, ensuring its security is a responsibility GitHub takes seriously. Transparency is key in maintaining the trust of our community. Today, we are sharing details of recent incidents on the npm registry, the details of our investigations, and how we’re continuing to invest in the security of npm.
Click to expand...

Log in or Sign up

NPM fixes private package names leak, serious authorization bug

guest Guest

Log in or Sign up

NPM fixes private package names leak, serious authorization bug

guest Guest

Useful Searches