JavaScript registry NPM vulnerable to 'manifest confusion' abuse

1. steal-ur-stuff

   1 8 23 0.0

   Steal Ur Stuff

   

   I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff

   It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724

2. Civic Auth

   www.civic.com featured

   Auth in Less Than 5 Minutes. Civic Auth comes with multiple SSO options, optional embedded wallets, and user management — all implemented with just a few lines of code. Start building today.

   

3. npm

   2 52 17,233 2.1 JavaScript

   I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff

   It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724

4. npm-lint

   3 4 26 0.0 TypeScript

   A linter for npm & node package.json files with a focus on dependency security

   

   That postinstall and other scripts have been a problem for a long time - the PoC for example could be installed via npx, which would then run postinstall which executes another script to steal /etc/password data.

   This is not a new problem, you just have another vector.

   I came up with a free linter package to try solve it - but no one seemed interested, and here we are 7 later talking about where people are now offering paid services to mitigate it.

   https://github.com/tanepiper/npm-lint

Suggest a related project