Hardening Your npm and pnpm Configs in the Age of Shai-Hulud
A copy-paste-ready .npmrc and pnpm-workspace.yaml that actually defends against the supply-chain attacks of 2025 and 2026 — with the threat model behind every directive.
The Node.js Secure Coding Blog
-
-
Argument Injection vulnerability in git-blame@1.4.0
The git-blame npm package is vulnerable to Argument Injection via the `rev` parameter allowing arbitrary command injection.
-
Argument Injection vulnerability in `gits@0.1.8`
An Argument Injection vulnerability was discovered in the `gits` npm package that could allow attackers to execute arbitrary commands on the host
-
Command Injection vulnerability in `@fab1o/git@1.4.0`
A Command Injection vulnerability in the `@fab1o/git` npm package allows attackers to execute arbitrary commands on the host system via unsanitized user input passed to the `exec()` function.
-
Command Injection vulnerability in `git-contributors` via unsanitized CLI arguments
A Command Injection vulnerability was discovered in the `git-contributors` npm package that allows attackers to execute arbitrary commands by manipulating the options object passed to the library's API.
-
Command Injection vulnerability in `git-q@0.0.3`
Publicly disclosing a Command Injection vulnerability in the `git-q` npm package, which allows attackers to execute arbitrary commands on the host system via unsanitized user input.
