CVE-2021-43616

Insufficient Verification of Data Authenticity in npm/npm

Identifiers

CVE-2021-43616

Package Slug

npm/npm

Vulnerability

Insufficient Verification of Data Authenticity

Description

The npm ci command in npm proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.

Affected Versions

All versions starting from 7.0.0 up to 7.24.2, all versions starting from 8.0.0 up to 8.1.3

Solution

Upgrade to version 8.1.4 or above.

Last Modified

2021-11-18

source