Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=
Remediation
References
https://github.com/nodejs/node/pull/43210
https://github.com/nodejs/node/releases/tag/v16.15.1
https://github.com/nodejs/node/releases/tag/v17.9.1
https://github.com/nodejs/node/releases/tag/v18.3.0
https://github.com/npm/cli/releases/tag/v8.11.0
https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
https://github.com/npm/npm-packlist
https://security.netapp.com/advisory/ntap-20220722-0007/
Related Vulnerabilities
CVE-2023-45133 Vulnerability in maven package org.webjars.npm:babel__traverse
CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-core-client
CVE-2023-4863 Vulnerability in npm package electron
CVE-2011-2487 Vulnerability in maven package org.apache.ws.security:wss4j
CVE-2020-27218 Vulnerability in maven package org.eclipse.jetty:jetty-server