GMS-2020-105: Global node_modules Binary Overwrite in bin-links
Versions of bin-links
are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve
binary, any subsequent installs of packages that also create a serve
binary would overwrite the first binary. This behavior is still allowed in local installations.
References
Detect and mitigate GMS-2020-105 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →