🦄 Node.js Security

Popular JavaScript polyfill library delivers malware, Node.js core performance boosts and more

malware code found in polyfill.js library from cdn.polyfill.io

Polyfill supply chain attack embeds malware in JavaScript CDN assets — What started as a polyfill JavaScript library sell-off in which maintainer Andrew Betts transferred GitHub repository rights to a third-party company ended up as a malware distribution vehicle for a Chinese malicious actor, now putting in danger as much as 4% of the web. [snyk]

Headlines

​Rafael Gonzaga tee up upcoming UDP support in Node.js permission model [github]

​Yagiz Nizipli continues the performance speed-up quest for gains in fs.existsSync() on Windows [github]

​ ​Electron got tricked to solve Math issues ended up with Remote Code Execution — Electron has been well recognized for bloat and performance issues, as well as the once-in-a-while security vulnerability and this time it’s all about Cross-site Scripting due to a vulnerable Preload API surface and up to code execution [0reg.dev]

The security vulnerability of serving images via a route as opposed to static middleware in Node.js [nodejs-security.com]

In other news, a tutorial on the devto website wants to teach developers about building Node.js servers and completely fails to provide security disclaimers or follow secure coding practices. Surely, there are other issues at play but I’ll give the author the benefit of the doubt they wanted to teach the basics. Hopefully you can find the security issues here:

Insecure coding conventions leading to path traversal vulnerabilities and arbitrary file read and arguably no rate limits

On npm

  • ​my-ua-parser​ - by Matteo Collina is a fork of the popular ua-parser-js package that you should switch to due to recent license changes​.

  • ​kysely-ctl​ - by Igal Klebanov, this npm package is a handy command-line tool for Kysely, if you’re into strongly typed query builders.

New Security Vulnerabilities

Hiring

ICYMI - node:test now supports experimental ESM+CJS module mocking it will remain experimental at least until the folks maintaining node figure out how they want module hooks to work, June 19, 2024​

— Colin Ihrig, June 19, 2024

On the same note, Colin also added support for test plans in Node.js built-in test runner, available in Node.js 20.15.0.

Node.js Security Newsletter

Subscribe to get everything in and around the Node.js security ecosystem, direct to your inbox.

    JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more.

    Built with ConvertKit