Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lerna/lerna

              main @ 8334afa
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

Arbitrary Code Execution: 2 prior fixes. Scrutinize any change in this area.

PublishCommand: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Arbitrary Code Execution: Execution of arbitrary lifecycle scripts during package-lock updates could allow malicious packages to run code during versioning; mitigated by enforcing `--ignore-scripts` during npm installs.

Arbitrary Code Execution: Automatic execution of raw JS lifecycle scripts matching specific naming patterns relative to package roots allowed code execution; mitigated by requiring an explicit `--require-scripts` opt-in flag.

Code Injection: Writing unescaped paths directly into generated JavaScript bootstrap files allowed arbitrary code execution; resolved by using `JSON.stringify` to escape target paths.