Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=
Remediation
References
https://github.com/nodejs/node/pull/43210
https://github.com/nodejs/node/releases/tag/v16.15.1
https://github.com/nodejs/node/releases/tag/v17.9.1
https://github.com/nodejs/node/releases/tag/v18.3.0
https://github.com/npm/cli/releases/tag/v8.11.0
https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
https://github.com/npm/npm-packlist
https://security.netapp.com/advisory/ntap-20220722-0007/
Related Vulnerabilities
CVE-2021-40822 Vulnerability in maven package org.geoserver:gs-main
CVE-2022-36888 Vulnerability in maven package com.datapipe.jenkins.plugins:hashicorp-vault-plugin
CVE-2021-42392 Vulnerability in maven package com.h2database:h2
CVE-2021-21179 Vulnerability in maven package org.webjars.npm:electron
CVE-2021-21120 Vulnerability in maven package org.webjars.npm:electron