Invisible npm malware – evading security checks with crafted versions

The npm CLI's security feature, which checks for vulnerabilities in packages and their dependencies, exhibits a significant flaw when dealing with package versions that include a hyphen, which are considered pre-release versions according to Semantic Versioning. This flaw prevents npm from reporting known vulnerabilities for such packages, as demonstrated by a discrepancy between npm and JFrog Xray in detecting vulnerabilities in the package cruddl 2.0.0-update.2. The npm Bulk Advisory endpoint fails to retrieve advisories for these versions due to its handling of pre-release tags, which could be exploited by attackers to evade security checks. Developers are advised to avoid installing pre-release npm packages unless they are from a highly reputable source, and to return to non-pre-release versions as soon as possible.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.