Manifest confusion issues in NPM packages which could raise malware distribution risk could be discovered by a new Python-based tool developed by sysadmin Felix Pankratz, reports BleepingComputer. New packages’ manifest data could be altered by threat actors to remove dependencies so as not to appear in the NPM registry but would still be executed upon the installation of the package, which may result in cache poisoning, downgrade attacks, and other types of compromise, noted former GitHub and NPM Engineering Manager Darcy Clarke.

Source: SC Magazine