Security News > 2022 > November > Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection

New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "Unexpected behavior" in the npm command line interface tool.

Npm CLI's install and audit commands have built-in capabilities to check a package and all of its dependencies for known vulnerabilities, effectively acting as a warning mechanism for developers by highlighting the flaws.

Specifically, the problem arises only when the installed package version contains a hyphen, which is included to denote a pre-release version of an npm module.

While the project maintainers treat the discrepancy between regular npm package versions and pre-release versions as an intended functionality, this also makes it ripe for abuse by attackers looking to poison the open source ecosystem.

"Threat actors could exploit this behavior by intentionally planting vulnerable or malicious code in their innocent-looking packages which will be included by other developers due to valuable functionality or as a mistake due to infection techniques such as typosquatting or dependency confusion," Or Peles said.

To counter such threats, it's recommended that developers avoid installing npm packages with a pre-release version, unless the source is known to be completely reliable.

News URL

https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html