Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of nodemodules. It is possible for packages to create symlinks to files outside of the nodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the npm install are affected.

References:

https://www.npmjs.com/advisories/1436 https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/ https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli