npm, the world's largest software registry, is essential for JavaScript developers. However, its popularity also makes it a target for security vulnerabilities.

In this article, we will look at five notable npm vulnerabilities, their impacts, and how to mitigate them.

1) Insertion of Sensitive Information into Log File

This vulnerability led to sensitive information, like passwords, being logged in plain text, which could then be accessed by unauthorized users. It particularly affected versions of npm before 6.14.6.

• CVE: CVE-2020-15095

• Published: The vulnerability was published on July 7, 2020.

• How to fix it: Upgrading npm to version 6.14.6 or higher is the recommended solution to mitigate this vulnerability, ensuring that sensitive information is no longer logged in plain text.

2) Arbitrary File Write

This vulnerability allowed attackers to write files to arbitrary locations on the system, which could lead to unauthorized access or control.

• CVE: CVE-2019-16776

• Published: The vulnerability was published on December 11, 2019.

• How to fix it: Updating npm to version 6.13.3 or later can fix this issue, preventing attackers from writing files to unintended locations.

3) Unauthorized File Access

This issue enabled the creation of symlinks to files outside the node_modules folder, leading to unauthorized access to these files.

• CVE: CVE-2019-16775

• Published: The vulnerability was published on December 11, 2019.

• How to fix it: To resolve this vulnerability, it is advised to upgrade npm to version 6.13.3 or higher, which prevents the creation of unauthorized symlinks.

4) Arbitrary File Overwrite

This vulnerability was due to npm allowing globally installed binaries to be overwritten by other package installations, which could be exploited to replace them with malicious binaries.

• CVE: CVE-2019-16777

• Published: The vulnerability was published on December 11, 2019.

• How to fix it: The recommended fix is to upgrade npm to version 6.13.4 or above, which prevents the overwriting of existing binaries by other package installations.

5) Access Restriction Bypass

This vulnerability allowed users to bypass intended filesystem access restrictions, affecting npm versions before 5.7.1. It was related to unexpected changes in the ownership of /etc and /usr directories.

• CVE: CVE-2018-7408

• Published: The vulnerability was published on March 21, 2018.

• How to fix it: The mitigation involves upgrading npm to version 5.7.1 or higher, which resolves the issue related to filesystem access restrictions.