How NPM’s Binary Planting Bug Lets Attackers Access Any File

On December 11, 2019, the npm team blog issued a security warning about “binary injection” affecting npm versions prior to v6.13.3 and v6.13.4.

Arbitrary File Access

The vulnerability allows a package publisher to craft a malicious entry in the bin field that can read or modify any file on the user’s system.

If exploited, a malicious package combined with social engineering—such as replacing a package with a mining script or abusing lockfile attacks—could cause severe damage.

Although npm did not disclose full details, analysis of the commit history of read-package-json shows that relative paths can be used to access resources.

Binary Planting

The second vulnerability permits globally installed packages to replace any executable file in the installation directory.

Global packages typically create symlinks in system directories like /usr/local/bin. While this does not grant arbitrary file access, it can be more damaging because the malicious executable persists and runs on each invocation. For example, a compromised ssh command could leak login credentials.

Testing npm’s test cases can help understand the details; interested readers can follow the links in the “Related Reading” section.

Although npm has not observed any exploited packages yet, it advises users to upgrade promptly.