CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
58.3%
npm pack
ignores root-level .gitignore
& .npmignore
file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces
, --workspace=<name>
). Anyone who has run npm pack
or npm publish
with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include.
npm
(v8.11.0
or greater), run: npm i -g npm@latest
v16.15.1
, v17.19.1
& v18.3.0
include the patched v8.11.0
version of npm
npm publish --dry-run
or npm pack
with an npm
version >=7.9.0
& <8.11.0
inside the projectโs root directory using a workspace flag like: --workspaces
or --workspace=<name>
(ex. npm pack --workspace=foo
)tar -tvf <package-on-disk>
also works)npm deprecate <pkg>[@<version>] <message>
)github.com/advisories/GHSA-hj9c-8jmm-8c52
github.com/nodejs/node/pull/43210
github.com/nodejs/node/releases/tag/v16.15.1
github.com/nodejs/node/releases/tag/v17.9.1
github.com/nodejs/node/releases/tag/v18.3.0
github.com/npm/cli/releases/tag/v8.11.0
github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
github.com/npm/cli/tree/latest/workspaces/libnpmpack
github.com/npm/cli/tree/latest/workspaces/libnpmpublish
github.com/npm/npm-packlist
nvd.nist.gov/vuln/detail/CVE-2022-29244
security.netapp.com/advisory/ntap-20220722-0007/
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
58.3%