Why npm lockfiles can be a security blindspot for injecting malicious modules
Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
lockfile-lint github.com
Lint lockfiles for improved security and trust policies to mitigate malicious package injection and insecure lockfile resources.
-
How a Single Vulnerability Can Bring Down the JavaScript Ecosystem landh.tech
Cache poisoning attack on the NPM registry rendering packages unavailable.
-
Node.js Secure Coding: Defending Against Command Injection Vulnerabilities nodejs-security.com
Learn secure coding conventions in Node.js by executing command injection attacks on real-world npm packages and analyzing vulnerable code.
-
The massive bug at the heart of the npm ecosystem blog.vlt.sh
NPM Manifest Confusion.
-
synp github.com
Convert yarn.lock to package-lock.json and vice versa.
-
How We Hacked a Software Supply Chain for $50K landh.tech
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
CI/CD Attacks › Techniques > Defense Evasion: “Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly.”