CodeVetter · Repo Unpack · Risk map
npm/cli
These findings describe source-level trust boundaries and behavioral hazards, not confirmed vulnerabilities. Installation can execute project code, mutate configured filesystem locations, and consume registry metadata with credentials. Configuration and script-policy behavior have branches that comments alone do not fully explain. Mocked tests and unexecuted CI leave runtime and live-provider behavior unverified.
- NpmExtension.load imports or requires project-selected code in-process; cloning manifests and restricting returned fields constrain transformation results but do not sandbox module-level execution.
- Hypothesis requiring validation: discover checks extension-file containment using resolved path strings, then reads/imports that path; a symlink's real target may escape that lexical root boundary. This inspection does not establish exploitability. (inferred)
- Bare install runs root preinstall before strictAllowScriptsPreflight; strict dependency-script checks therefore do not precede all root-owned code execution.
- ci clears node_modules before root preinstall, so a failing bootstrap script can leave existing installations removed; dry-run guards cleanup but does not guard the root lifecycle calls.
- Exec says its policy should consult user/global npmrc only, but resolveAllowScripts still probes project/user/global/builtin sources when skipProjectConfig is true; that flag skips package.json rather than the project npmrc source.
- User credentials are serialized into a configured file, with passwords base64-encoded rather than encrypted and chmod applied after writing; Npm also creates configured caches/log directories and labels argv redaction best-effort.
- Publish dry-run suppresses libpub but still reaches directory lifecycle hooks, OIDC setup, and registry version checks; #registryVersions catches any fetch/parsing error and returns an empty version set.
- Reify has staged rollback for retirement, sparse-tree creation, unpacking, and builds, but explicitly performs final trash removal without rollback; linked installs also temporarily swap tree representations and restore them in finally.