CVE-2019-16776

Name of the Vulnerable Software and Affected Versions: npm CLI versions prior to 6.13.3

Description: The issue exists due to incorrect restriction of the path name to a directory with limited access. Exploitation may allow a remote attacker to write arbitrary files by creating a symbolic link to files outside the node modules directory or by manipulating the bin field in package.json. This behavior is still possible through install scripts and bypasses the --ignore-scripts install option. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed.

Recommendations: Upgrade to version 6.13.3 or later. As a temporary workaround, consider restricting access to the bin field in package.json to minimize the risk of exploitation. Avoid using the bin field in package.json until the issue is resolved.