SIX JAVASCRIPT ZERO-DAY BUGS LEAD TO FEARS OF SUPPLY CHAIN ATTACK

Summary from the TLDR InfoSec newsletter

Researchers from Koi discovered six zero-day vulnerabilities dubbed "PackageGate" across four major JavaScript package managers (npm, pnpm, vlt, and Bun) that bypass protections against script execution and lockfile integrity designed to prevent malicious code from running automatically. While pnpm, vlt, and Bun patched the flaws, npm (now owned by Microsoft) declined to fix the vulnerabilities, stating that the behavior "works as expected," leaving gaps in defenses adopted after the Shai-Hulud supply chain attack that affected over 25,000 repositories. The bypasses vary by tool—npm's weakness lies in Git dependencies with malicious .npmrc files, pnpm and vlt have lockfile gaps enabling tarball swapping, vlt has a tar extraction path traversal flaw, and Bun's trust allowlist can be spoofed—raising concerns about potential install-time code execution at scale even in hardened environments.