Description
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=
Remediation
References
https://github.com/nodejs/node/pull/43210
https://github.com/nodejs/node/releases/tag/v16.15.1
https://github.com/nodejs/node/releases/tag/v17.9.1
https://github.com/nodejs/node/releases/tag/v18.3.0
https://github.com/npm/cli/releases/tag/v8.11.0
https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
https://github.com/npm/npm-packlist
https://security.netapp.com/advisory/ntap-20220722-0007/
Related Vulnerabilities
CVE-2020-16044 Vulnerability in npm package electron
CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-macro-html
CVE-2022-1295 Vulnerability in npm package fullpage.js
CVE-2013-6465 Vulnerability in maven package org.jbpm:jbpm-console-ng-human-tasks-client
CVE-2020-1925 Vulnerability in maven package org.apache.olingo:odata-client-core