CVE-2019-16777

The CVE-2019-16777 entry affects the npm CLI for versions prior to 6.13.4, which are vulnerable to Arbitrary File Overwrite. The issue allows overwriting globally-installed binaries (e.g., a serve binary) during subsequent package installations, including when --ignore-scripts is used. This behav...

CVE-2019-16775

CVE-2019-16775 concerns the npm CLI prior to version 6.13.3. The vulnerability allows a package publisher to create symlinks to arbitrary files outside the node_modules folder via the package.json bin field during installation, and the behavior can also occur through install scripts. This could e...

CVE-2019-16776

CVE-2019-16776 affects the npm CLI prior to 6.13.3 and arises from improper handling of the bin field. A crafted bin entry can cause arbitrary file writes outside the intended node_modules folder, enabling a publisher to modify or access arbitrary files on a user’s system during installation; exp...

CVE-2020-15095

CVE-2020-15095: npm CLI prior to 6.14.6 is vulnerable to information exposure through log files where credentials in URLs are printed to stdout and logs. The impact is exposure of user credentials via logs/logs-generated files. Affected: npm CLI (versions

CVE-2021-43616

CVE-2021-43616 describes a behavior in the npm CLI where running the npm ci command (npm 7.x and 8.x up to 8.1.3) proceeds with installation even if dependency information in package-lock.json differs from package.json. The description notes this is inconsistent with the documentation and could a...

CVE-2022-29244

CVE-2022-29244: npm pack/publish in a workspace may publish files excluded by root .gitignore/.npmignore. Affected: npm v7.9.0 and v7.13.0; patched in npm v8.11.0. Node.js v16.15.1, v17.19.1, v18.3.0 include the patched npm. Remediation: upgrade npm to the latest (npm i -g npm@latest).

CVE-2016-3956

CVE-2016-3956 describes an HTTP bearer token leak in the npm CLI, allowing a remote attacker to obtain sensitive information via Authorization headers. Affected npm versions include prior to 2.15.1 and 3.x prior to 3.8.3, used with Node.js 0.10 (before 0.10.44), 0.12 (before 0.12.13), 4 (before 4...

CVE-2018-7408

Technical details for CVE-2018-7408 are not publicly available in the provided connected documents. No concrete specifics on affected products, versions, or impact are present beyond the Initial Description. Monitor for updates.