Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [npm]

npm is a package manager for Node.js

Filter by
Sorted by
Tagged with
0 votes
0 answers
48 views

Does Node.js's npm provide cryptographic authentication and integrity validation?

Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
1 vote
2 answers
211 views

How serious are npm module vulnerabilities?

Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them. I've seen plenty of articles that talk about the rise in malware/spam in npm packages: ...
fyrekcaz's user avatar
2 votes
1 answer
172 views

Where to query for CVEs present in a version of a software project like npm packages of python modules?

In node, I can run npm audit and it will show me known vulnerabilities for the versions my dependencies are using. That's cool and all, but I'd like to be able to do the following, on some website or ...
KoenDG's user avatar
  • 21
0 votes
1 answer
103 views

How is the npm package manager made robust security-wise, what are the keys they are using, and how do they use them?

I am specifically looking at the npm package metadata like from the lodash package, the relevant part which is this: { "shasum": "392617f69a947e40cec7848d85fcc3dd29d74bc5", &...
Lance's user avatar
  • 632
1 vote
0 answers
201 views

Is there a database that classifies NPM library vulnerabilities as exploitable vs. benign in the browser?

I maintain several Angular apps, which contain thousands of dependencies on NPM packages. GitHub's Dependabot notifies me of new known vulnerabilities every week (from the CVE database). For example, ...
Jonathan Fuerth's user avatar
1 vote
0 answers
484 views

Restrict node.js filesystem access

I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine. When Node starts, the script has access to the files outside its directory (as least by default), so ...
Oleg's user avatar
  • 309
2 votes
1 answer
181 views

Basically only 2 ways of npm supply chain attacks?

Almost every week you can read about attacks performed through compromised npm libraries. The npm ecosystem is vast and unmanageable and for it-sec people it is frustrating to deal with all the ...
user3240316's user avatar
1 vote
1 answer
272 views

How does npm’s ECDSA signing system improve security?

I have not been able to find a single page that actually explains how npm’s ECDSA signing system works. The closest I could find is the official documentation, but as far as I can tell from that ...
Brian Drake's user avatar
1 vote
2 answers
202 views

How to securely use `pass`, `sudo`, and `npm` on the same machine

TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store. I use pass as a password manager, on Linux. And like probably all Linux users, I ...
Zwyx's user avatar
  • 113
12 votes
3 answers
4k views

How to vet third-party developer packages

Looking to create a form where developers can submit requests for packages to be installed. We want to create a list of questions that can help us determine whether or not a package is safe. What are ...
user277711's user avatar
1 vote
1 answer
211 views

Is there a way to check if vulnerability introduced by npm package is reachable/exploitable

I have a problem where I have too many vulnerabilities on a few hundred repositories introduced with outdated npm packages. The issue is that I need to find a way to prioritize this. The biggest pain ...
4tire's user avatar
  • 11
10 votes
2 answers
3k views

Are devDependencies in Node.js exploitable?

I am well aware that the best approach is to update any dependency, no matter whether it is a development dependency or a runtime/production dependency. But from a research prospective, I want to know ...
LGDGODV's user avatar
  • 173
3 votes
2 answers
369 views

How much damage can a malicious package do with just "npm install <package>"?

I had a typo and npm installed something that is similar in name to something very popular -- I was concerned about typosquatting. It's quite plausibly legitimate and just a coincidence. I looked at ...
user237586's user avatar
0 votes
1 answer
435 views

How to prioritize npm dev vulnerabilities? [duplicate]

Running SNYK scanning on my code base I find a number of HIGH vulnerabilities when I include the npm dev dependencies (e.g. running SNYK -dev test --file=package.json). Examples of vulnerabilities: ...
Tobias Uldall-Espersen's user avatar
0 votes
0 answers
166 views

Can I get hold of malicious npm packages?

the npm advisories site lists quite a lot of malicious packages which - in my understanding - are not packages with vulnerabilities but malicious per se. These packages were removed from the npm repo ...
pinas's user avatar
  • 171
0 votes
2 answers
2k views

Which database is used by npm-audit

you probably know the npm-audit tool which informs you about vulns in your node.js projects dependencies. I'd like to know what database npm-audit is using and how I get access to this data. Thank ...
pinas's user avatar
  • 171
3 votes
2 answers
690 views

How do I get the "vulnerabilities history" of a Node.js package?

When installing a Node.js package via npm or when running npm-audit I get information about known vulnerabilities of packages in the project. From my understanding this means that there must be some ...
pinas's user avatar
  • 171
5 votes
1 answer
3k views

How to deal with prototype pollution attack vulnerability in lodash?

lodash has been reported to be vulnerable to the so called prototype pollution attack in versions up to (excluding) 4.17.5 See https://nvd.nist.gov/vuln/detail/CVE-2018-3721 Now lodash is the most ...
borisdiakur's user avatar
2 votes
1 answer
343 views

How can the validity and safety of a software library be checked?

So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
Rehket's user avatar
  • 23
1 vote
1 answer
1k views

How secure is WebPack? [closed]

If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority? Edit: when using WebPack you should use NPM-...
Alex's user avatar
  • 13
3 votes
2 answers
3k views

Is it OK to not update devdependencies?

When checking third party libraries used in package.json and build.gradle files with tools such as Snyk, they allow the option to check for devdependencies. A lot of the time there is vulnerabilities ...
vegedezozu's user avatar
8 votes
3 answers
1k views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
alecxe's user avatar
  • 1,605
2 votes
1 answer
385 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
kmiklas's user avatar
  • 129
-2 votes
2 answers
172 views

How secure open source packages are? [closed]

When we clone git projects to use as is or when we install free npm packages provided by third party sources, is there any security risk? how trustworthy such packages are for production environment?
Priyanka Desai's user avatar
4 votes
1 answer
278 views

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title: I’m harvesting credit card numbers and passwords from your site....
Ogglas's user avatar
  • 777
4 votes
0 answers
140 views

What are commonly used security practices when writing a hybrid mobile app with a framework like ionic 2?

I'm new to hybrid app development and web development in general. Are there common coding practices/techniques I can use to ensure that I write code which does not put the end user at risk of ...
ThisIsNotAnId's user avatar
0 votes
0 answers
310 views

Does `npm install` retrieve binaries or sources?

I am starting to use npm install a lot for development, but I fear about its security consequences. Does npm install retrieve binaries or sources? If it's binaries, it's already a deal breaker for ...
knocte's user avatar
  • 161
6 votes
1 answer
783 views

How do atom's apm and npm verify package integrity?

Are there built in verification methods to make sure the packages contain the correct code? Do they use a hash of some sort?
user's user avatar
  • 829
16 votes
1 answer
935 views

Unpublished modules on npm: could an attacker take advantage of their former notoriety?

Earlier this week, Azer Koçulu decided to unpublish his modules from npm, the default package manager for Node.js. He had published 273 modules in total. Some major modules, like Babel and React, ...
Benoit Esnard's user avatar