CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.

Weakness

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Affected Software

Name	Vendor	Start Version	End Version
Npm	Npmjs	7.0.0 (including)	7.24.2 (including)
Npm	Npmjs	8.0.0 (including)	8.1.3 (including)
Red Hat Enterprise Linux 8	RedHat	nodejs:16-8060020220519144917.ad008a3a	*
Npm	Ubuntu	bionic	*
Npm	Ubuntu	devel	*
Npm	Ubuntu	esm-apps/jammy	*
Npm	Ubuntu	esm-apps/noble	*
Npm	Ubuntu	hirsute	*
Npm	Ubuntu	impish	*
Npm	Ubuntu	jammy	*
Npm	Ubuntu	kinetic	*
Npm	Ubuntu	lunar	*
Npm	Ubuntu	mantic	*
Npm	Ubuntu	noble	*
Npm	Ubuntu	oracular	*
Npm	Ubuntu	plucky	*
Npm	Ubuntu	questing	*
Npm	Ubuntu	trusty	*
Npm	Ubuntu	upstream	*
Npm	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-43616
CWE	https://cwe.mitre.org/data/definitions/345.html

Insufficient Verification of Data Authenticity

Weakness

Affected Software

References

CVE-2021-43616

Insufficient Verification of Data Authenticity

Weakness

Affected Software

Related Attack Patterns

References