NodeJS/npm/7.10.0


a package manager for JavaScript

https://www.npmjs.com/package/npm
Artistic-2.0

1 Security Vulnerabilities

Packing does not respect root-level ignore files in workspaces

Published date: 2022-06-02T15:37:27Z
CVE: CVE-2022-29244
Links:

Impact

npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include.

Patch

  • Upgrade to the latest, patched version of npm (v8.11.0 or greater), run: npm i -g npm@latest
  • Node.js versions v16.15.1, v17.19.1 & v18.3.0 include the patched v8.11.0 version of npm

Steps to take to see if you're impacted

  1. Run npm publish --dry-run or npm pack with an npm version >=7.9.0 & <8.11.0 inside the project's root directory using a workspace flag like: --workspaces or --workspace=<name> (ex. npm pack --workspace=foo)
  2. Check the output in your terminal which will list the package contents (note: tar -tvf <package-on-disk> also works)
  3. If you find that there are files included you did not expect, you should: 3.1. Create & publish a new release excluding those files (ref. Keeping files out of your Package) 3.2. Deprecate the old package (ex. npm deprecate <pkg>[@<version>] <message>) 3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed ### References
  4. CVE-2022-29244
  5. npm-packlist
  6. libnpmpack
  7. libnpmpublish

Affected versions: ["7.9.0", "7.10.0", "7.11.0", "7.11.1", "7.11.2", "7.12.0", "7.12.1", "7.13.0", "7.14.0", "7.15.0", "7.15.1", "7.16.0", "7.17.0", "7.18.0", "7.18.1", "7.19.0", "7.19.1", "7.20.0", "7.20.1", "7.20.2", "7.20.3", "7.20.4", "7.20.5", "7.20.6", "7.21.0", "7.21.1", "7.22.0", "7.23.0", "7.24.0", "7.24.1", "7.24.2", "8.0.0", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.4.0", "8.4.1", "8.5.0", "8.5.1", "8.5.2", "8.5.3", "8.5.4", "8.5.5", "8.6.0", "8.7.0", "8.8.0", "8.9.0", "8.10.0"]
Secure versions: [6.14.6, 6.14.7, 7.0.0-beta.0, 7.0.0-beta.1, 7.0.0-beta.2, 7.0.0-beta.3, 7.0.0-beta.4, 6.14.8, 7.0.0-beta.5, 7.0.0-beta.6, 7.0.0-beta.7, 7.0.0-beta.8, 7.0.0-beta.9, 7.0.0-beta.10, 7.0.0-beta.11, 7.0.0-beta.12, 7.0.0-beta.13, 7.0.0-rc.0, 7.0.0-rc.1, 7.0.0-rc.2, 7.0.0-rc.3, 7.0.0-rc.4, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.12, 7.0.13, 6.14.9, 7.0.14, 7.0.15, 7.1.0, 7.1.1, 7.1.2, 7.2.0, 6.14.10, 7.3.0, 7.4.0, 6.14.11, 7.4.1, 7.4.2, 7.4.3, 7.5.0, 7.5.1, 7.5.2, 7.5.3, 7.5.4, 7.5.5, 7.5.6, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.7.0, 7.7.1, 7.7.2, 7.7.3, 7.7.4, 6.14.12, 7.7.5, 7.7.6, 7.8.0, 6.14.13, 6.14.14, 6.14.15, 6.14.16, 6.14.17, 8.11.0, 8.12.0, 8.12.1, 8.12.2, 8.13.0, 8.13.1, 8.13.2, 8.14.0, 8.15.0, 8.15.1, 8.16.0, 8.17.0, 8.18.0, 8.19.0, 8.19.1, 9.0.0-pre.0, 8.19.2, 9.0.0-pre.1, 9.0.0-pre.2, 9.0.0-pre.3, 9.0.0-pre.4, 9.0.0-pre.5, 9.0.0-pre.6, 9.0.0, 9.0.1, 9.1.0, 8.19.3, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 6.14.18, 9.3.0, 9.3.1, 9.4.0, 9.4.1, 9.4.2, 8.19.4, 9.5.0, 9.5.1, 9.6.0, 9.6.1, 9.6.2, 9.6.3, 9.6.4, 9.6.5, 9.6.6, 9.6.7, 9.7.0, 9.7.1, 9.7.2, 9.8.0, 9.8.1, 10.0.0-pre.0, 10.0.0-pre.1, 10.0.0, 10.1.0, 10.2.0, 9.9.0, 10.2.1, 10.2.2, 10.2.3, 9.9.1, 9.9.2, 10.2.4, 10.2.5, 10.3.0, 10.4.0, 9.9.3, 10.5.0, 10.5.1, 10.5.2, 10.6.0, 10.7.0, 10.8.0, 10.8.1, 10.8.2, 10.8.3, 10.9.0]
Recommendation: Update to version 10.9.0.

553 Other Versions

Version License Security Released
1.4.12 Artistic-2.0 7 2014-05-23 - 16:54 over 10 years
1.4.11 Artistic-2.0 7 2014-05-23 - 01:06 over 10 years
1.4.10 Artistic-2.0 7 2014-05-06 - 01:17 over 10 years
1.4.9 Artistic-2.0 7 2014-05-01 - 23:25 over 10 years
1.4.8 Artistic-2.0 7 2014-05-01 - 17:54 over 10 years
1.4.7 Artistic-2.0 7 2014-04-15 - 22:27 over 10 years
1.4.6 Artistic-2.0 7 2014-03-19 - 16:19 over 10 years
1.4.5 Artistic-2.0 7 2014-03-19 - 00:23 over 10 years
1.4.4 Artistic-2.0 7 2014-02-20 - 16:05 over 10 years
1.4.3 Artistic-2.0 7 2014-02-17 - 04:38 over 10 years
1.4.2 Artistic-2.0 7 2014-02-14 - 00:32 over 10 years
1.4.1 Artistic-2.0 7 2014-02-14 - 00:16 over 10 years
1.4.0 Artistic-2.0 7 2014-02-13 - 02:11 over 10 years
1.3.26 Artistic-2.0 7 2014-02-03 - 04:22 over 10 years
1.3.25 Artistic-2.0 7 2014-01-23 - 21:03 almost 11 years
1.3.24 Artistic-2.0 7 2014-01-20 - 05:12 almost 11 years
1.3.23 Artistic-2.0 7 2014-01-03 - 18:27 almost 11 years
1.3.22 Artistic-2.0 7 2013-12-26 - 03:14 almost 11 years
1.3.21 Artistic-2.0 7 2013-12-17 - 22:27 almost 11 years
1.3.20 Artistic-2.0 7 2013-12-17 - 16:57 almost 11 years
1.3.18 Artistic-2.0 7 2013-12-16 - 23:50 almost 11 years
1.3.17 Artistic-2.0 7 2013-12-11 - 18:19 almost 11 years
1.3.16 Artistic-2.0 7 2013-12-11 - 17:35 almost 11 years
1.3.15 Artistic-2.0 7 2013-11-20 - 19:06 almost 11 years
1.3.14 Artistic-2.0 7 2013-11-08 - 21:39 almost 11 years
1.3.13 Artistic-2.0 7 2013-10-28 - 21:09 about 11 years
1.3.12 Artistic-2.0 7 2013-10-24 - 07:26 about 11 years
1.3.11 Artistic-2.0 7 2013-09-07 - 19:30 about 11 years
1.3.10 Artistic-2.0 7 2013-09-05 - 05:35 about 11 years
1.3.9 Artistic-2.0 7 2013-08-23 - 21:13 about 11 years
1.3.8 Artistic-2.0 7 2013-08-16 - 15:15 about 11 years
1.3.7 Artistic-2.0 7 2013-08-05 - 19:05 about 11 years
1.3.6 Artistic-2.0 7 2013-07-27 - 14:50 over 11 years
1.3.5 MIT +no-false-attribs 7 2013-07-24 - 20:22 over 11 years
1.3.4 MIT +no-false-attribs 7 2013-07-12 - 19:40 over 11 years
1.3.2 MIT +no-false-attribs 9 2013-07-12 - 18:35 over 11 years
1.3.1 MIT +no-false-attribs 9 2013-07-12 - 21:49 over 11 years
1.3.0 MIT +no-false-attribs 9 2013-07-12 - 21:49 over 11 years
1.2.32 MIT +no-false-attribs 9 2013-07-12 - 18:34 over 11 years
1.2.31 MIT +no-false-attribs 9 2013-07-12 - 21:48 over 11 years
1.2.30 MIT +no-false-attribs 9 2013-07-12 - 21:48 over 11 years
1.2.28 MIT +no-false-attribs 9 2013-07-12 - 21:47 over 11 years
1.2.27 MIT +no-false-attribs 9 2013-07-12 - 21:47 over 11 years
1.2.25 MIT +no-false-attribs 9 2013-07-12 - 21:47 over 11 years
1.2.24 MIT +no-false-attribs 9 2013-07-12 - 21:46 over 11 years
1.2.23 MIT +no-false-attribs 9 2013-07-12 - 21:46 over 11 years
1.2.22 MIT +no-false-attribs 9 2013-07-12 - 21:46 over 11 years
1.2.21 MIT +no-false-attribs 9 2013-07-12 - 21:45 over 11 years
1.2.20 MIT +no-false-attribs 9 2013-07-12 - 21:45 over 11 years
1.2.19 MIT +no-false-attribs 9 2013-07-14 - 19:04 over 11 years
1.1.71 MIT +no-false-attribs 9 2013-07-24 - 01:11 over 11 years
1.1.70 MIT +no-false-attribs 9 2013-07-24 - 01:11 over 11 years
1.1.25 MIT +no-false-attribs 9 2013-07-12 - 18:32 over 11 years