The Safety Issue Affecting NPM Developers: Manifest Confusion
The popular repository for NPM developers is currently facing a safety problem known as “Manifest Confusion”. This issue undermines confidence in packages and allows for the potential hiding of malicious code or the execution of malicious scripts during package installations.
NPM, which stands for Node Package Manager, is a widely used manager for the JavaScript programming language and is the default manager for the popular Node.js environment. Currently, there are over 17 million developers worldwide using NPM, with approximately 208 billion packages being downloaded each month.
In a blog post, Darcy Clark, a former engineer at GitHub, brought attention to the issue of manifest confusion. He explained that despite the knowledge of this problem by his former employer since at least November 2022, little has been done to address the associated risks. You can read his blog post here.
Due to its extensive selection of packages that can enhance application functionality without requiring additional development, the NPM registry has become extremely popular among developers. However, this popularity also makes it a prime target for attackers seeking to distribute harmful packages in order to compromise developers’ computers and infiltrate the supply chain.
Manifest confusion occurs when there is a discrepancy between the package information displayed in the NPM registry and the actual “Package.json” file within the published package’s archive that is used during installation.
The manifest sent to NPM during package publication and the “Package.json” file both contain information such as the package name, versions, and other metadata including scripts and dependencies. However, these data are sent separately to NPM, and the platform does not validate their consistency. As a result, the information can differ, and this inconsistency remains undetected until the package contents are examined.
This allows attackers to modify the manifest data to remove dependencies and scripts that are listed on the package page in the repository. However, these scripts and dependencies still exist within the “Package.json” file and will be executed upon package installation.
An image below provides a visual demonstration of the vulnerabilities caused by Manifest Confusion, illustrating a discrepancy between the package page and “Package.json” regarding dependencies.
The risks stemming from such