dogear

enter for all results · esc to close

The massive bug at the heart of the npm ecosystem

blog.vlt.shsite

NPM Manifest Confusion.

visit blog.vlt.sh ↗
0
sign in to dogear this
from
CI/CD Attacks
added
2026-10-10
likes
0

similar

  1. How a Single Vulnerability Can Bring Down the JavaScript Ecosystem landh.tech
    site category #cicd-attacks link ↗

    Cache poisoning attack on the NPM registry rendering packages unavailable.

  2. How We Hacked a Software Supply Chain for $50K landh.tech
    site category #cicd-attacks link ↗

    Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.

  3. Troubleshooting github.com
    site category #npm link ↗
  4. NPM Audit docs.npmjs.com
    site category #devsecops link ↗

    NPM - Vulnerable package auditing for node packages built into the npm CLI.

  5. Fixing npm permissions docs.npmjs.com
    site category #npm link ↗
  6. package.json docs.npmjs.com
    site category #npm link ↗

CI/CD Attacks › Techniques > Defense Evasion: “NPM Manifest Confusion.”