Trio of vulnerabilities made registry full of uncertain code even more of a risk
On Wednesday, NPM, Inc, the California-based biz that has taken it upon itself to organize the world's JavaScript packages into the npm registry, warned that its command line tool, the npm CLI, has a rather serious security vulnerability. Version 6.13.4 has been rushed out with a fix.
The flaw – also present in less-than-current versions of yarn, a Facebook-spawned open-source alternative client for fetching modules from the registry – could allow a hackers to alter the files on systems of users who have installed a malicious package.
That's a risk that exists independent of this ..
Support the originator by clicking the read the rest link below.
