Jordan Harband
4049296ca8
[Fix] nvm_die_on_prefix: never let a project .npmrc choose which npmrc file --delete-prefix edits
...
`nvm use --delete-prefix`, which nvm itself recommends when it finds a `prefix` or `globalconfig` setting, ran `npm config delete` from the current directory.
For a project `.npmrc`, it ran a bare `npm config delete prefix`/`globalconfig`, so npm loaded that untrusted file first, and its `userconfig`, `globalconfig`, or `location=global` keys picked which file npm rewrote, deleted, or chmodded to 0666 - eg, `~/.bashrc` or `~/.aws/credentials`.
The builtin and user branches pinned `--userconfig`, but still loaded the project file, so a project `location=global` plus an indented ` globalconfig=` (which nvm's check does not match) redirected those writes the same way.
`npm config delete` never edits the project file anyway, so that branch could not do what it claimed.
For the project npmrc, no longer run npm at all: with `--delete-prefix`, warn that project npmrc files are not modified and must be edited by hand, and continue, as before.
For the builtin, global, and user npmrc files, pass `--prefix` set to the version directory, so npm does not walk up from the current directory to load the project npmrc, and its global config resolves to that version's `etc/npmrc`.
Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-WYRTKBQ5.
2026-10-16 20:08:01 -07:00
..
2026-10-21 12:52:04 -07:00
2026-04-23 17:16:32 +03:00
2026-04-23 17:16:32 +03:00
2026-10-26 11:11:53 -07:00
2026-10-21 12:46:19 -07:00
2026-11-02 12:30:15 -06:00
2026-04-23 17:16:32 +03:00
2026-10-23 08:53:59 -07:00
2026-10-29 17:08:50 +00:00
2026-10-25 11:42:45 -07:00
2026-11-04 00:35:16 +05:30
2026-07-09 22:40:07 -07:00
2026-01-26 21:41:57 -08:00
2026-03-14 09:38:04 -07:00
2026-11-03 16:46:55 -06:00
2026-07-24 10:54:17 -07:00
2026-11-04 00:37:28 +05:30
2026-10-22 20:10:42 -07:00
2026-07-24 10:51:53 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 13:52:16 -07:00
2026-10-21 12:52:04 -07:00
2026-09-23 21:35:43 +00:00
2026-05-15 23:08:37 -07:00
2026-10-21 12:47:13 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 12:57:19 -07:00
2026-10-21 14:09:18 -07:00
2026-10-01 09:51:16 +05:30
2026-01-26 21:41:57 -08:00
2026-07-24 10:55:58 -07:00
2026-01-26 21:41:57 -08:00
2026-03-13 15:26:07 -04:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-09-21 10:01:34 +08:00
2026-01-26 21:41:57 -08:00
2026-10-23 08:53:59 -07:00
2026-09-28 15:05:28 +09:00
2026-10-09 21:16:17 -07:00
2026-10-14 20:53:08 +03:00
2026-10-01 16:35:00 +05:00
2026-01-26 21:41:57 -08:00
2016-11-14 12:28:41 +08:00
2026-01-26 21:41:57 -08:00
2026-09-04 14:08:01 -07:00
2026-03-13 15:26:07 -04:00
2026-07-08 13:02:41 -07:00
2026-07-08 13:02:41 -07:00
2026-07-08 13:02:41 -07:00
2026-10-16 20:08:01 -07:00
2026-10-23 08:53:59 -07:00
2026-07-08 13:03:16 -07:00
2026-10-23 08:53:58 -07:00
2026-10-23 08:53:59 -07:00
2026-06-02 17:41:44 -07:00
2026-09-02 19:36:04 -07:00
2026-10-23 08:53:59 -07:00
2026-01-26 21:41:57 -08:00
2026-03-14 14:30:31 -07:00
2026-10-23 08:53:58 -07:00
2026-10-16 22:02:45 -07:00
2026-06-03 13:09:07 -07:00
2026-10-06 17:54:48 -03:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-09-04 14:08:01 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 14:09:18 -07:00
2026-10-23 13:54:04 +03:00
2026-10-23 13:54:04 +03:00
2026-01-26 21:41:57 -08:00
2026-10-06 14:23:02 -03:00
2026-10-06 14:23:02 -03:00
2026-10-23 08:53:59 -07:00
2026-01-26 21:41:57 -08:00
2026-03-13 15:26:07 -04:00
2026-06-03 13:11:26 -07:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-11-02 01:47:37 +09:00
2026-11-02 01:47:37 +09:00
2025-11-16 14:48:10 +05:30
2026-07-08 13:03:16 -07:00
2026-10-22 20:10:42 -07:00
2026-03-13 15:26:07 -04:00
2026-09-02 19:40:47 -07:00
2026-10-06 14:23:02 -03:00
2026-01-26 21:41:57 -08:00
2026-01-27 10:31:07 -08:00
2026-09-29 17:08:36 +09:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-09-04 09:16:10 -07:00
2026-10-05 10:02:48 -07:00
2026-10-23 08:53:58 -07:00
2026-01-26 21:41:57 -08:00
2026-07-24 10:50:47 -07:00
2026-03-24 12:44:21 -07:00
2026-03-13 15:26:07 -04:00
2026-07-24 10:55:58 -07:00
2026-09-30 16:09:09 +09:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-03-24 12:44:21 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 14:09:18 -07:00
2026-10-23 08:53:58 -07:00
2026-10-21 13:09:25 -07:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-10-22 20:10:42 -07:00
2026-10-06 18:01:38 -03:00
2026-10-22 20:10:42 -07:00
2026-10-21 14:09:18 -07:00
2026-07-08 23:14:23 -07:00
2026-10-21 12:40:42 -07:00
2026-10-21 12:43:37 -07:00
2026-11-02 13:53:00 -06:00
2026-10-22 20:10:42 -07:00
2026-10-21 12:44:44 -07:00
2026-10-21 14:09:18 -07:00
2026-10-27 20:08:55 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 12:52:04 -07:00
2026-10-21 14:09:18 -07:00
2026-10-16 21:35:44 -07:00
2026-10-21 12:52:04 -07:00
2026-07-15 13:46:52 -07:00
2026-03-13 15:26:07 -04:00
2026-03-13 15:26:07 -04:00
2026-03-13 15:26:07 -04:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-10-16 21:35:44 -07:00
2026-10-21 14:09:18 -07:00
2026-01-26 21:41:57 -08:00
2026-10-21 12:39:00 -07:00
2026-09-03 20:54:28 -07:00
2026-03-13 15:26:07 -04:00
2026-01-26 21:41:57 -08:00
2026-09-03 15:12:34 -07:00
2026-03-13 15:26:07 -04:00
2026-11-03 14:42:50 -06:00
2026-03-13 15:26:07 -04:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-10-21 12:44:19 -07:00
2026-03-13 15:26:07 -04:00
2026-11-02 11:34:39 -06:00
2026-10-23 08:53:59 -07:00
2026-06-10 15:16:23 -07:00
2026-10-21 12:57:19 -07:00
2026-07-24 10:55:58 -07:00
2026-10-23 08:53:59 -07:00
2026-10-23 08:53:59 -07:00
2026-03-14 09:39:20 -07:00
2026-10-21 14:09:18 -07:00
2026-10-22 20:10:42 -07:00
2026-10-01 16:35:00 +05:00
2026-10-23 08:53:59 -07:00
2026-10-21 14:09:18 -07:00
2026-01-27 10:31:07 -08:00
2026-01-26 21:41:57 -08:00
2026-11-02 12:16:01 -06:00
2026-01-26 21:41:57 -08:00
2026-09-11 16:49:46 +08:00
2026-10-23 08:53:59 -07:00
2026-01-26 21:41:57 -08:00
2026-03-13 15:26:07 -04:00
2026-07-24 10:51:53 -07:00
2026-10-21 13:09:25 -07:00
2026-01-26 21:41:57 -08:00
2026-10-07 15:30:01 -03:00
2026-10-03 12:49:00 +05:30
2026-01-26 21:41:57 -08:00
2026-10-23 08:53:59 -07:00
2026-10-23 08:53:59 -07:00
2022-10-13 20:16:42 -07:00
2026-01-26 21:41:57 -08:00
2026-11-02 11:27:17 -06:00
2026-10-23 08:53:58 -07:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-01-26 21:41:57 -08:00
2026-05-25 11:14:39 +10:00
2026-09-03 20:44:59 -07:00