Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=
Remediation
References
https://github.com/nodejs/node/pull/43210
https://github.com/nodejs/node/releases/tag/v16.15.1
https://github.com/nodejs/node/releases/tag/v17.9.1
https://github.com/nodejs/node/releases/tag/v18.3.0
https://github.com/npm/cli/releases/tag/v8.11.0
https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
https://github.com/npm/npm-packlist
https://security.netapp.com/advisory/ntap-20220722-0007/
Related Vulnerabilities
CVE-2020-7662 Vulnerability in npm package websocket-extensions
CVE-2022-36092 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2021-32691 Vulnerability in npm package data-connector-rock
CVE-2021-46708 Vulnerability in npm package swagger-ui
CVE-2019-17267 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind