CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

• CWE-200

• https://github.com/nodejs/node/pull/43210Patch, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v16.15.1Release Notes, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v17.9.1Release Notes, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v18.3.0Release Notes, Third Party Advisory
• https://github.com/npm/cli/releases/tag/v8.11.0Release Notes, Third Party Advisory
• https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52Third Party Advisory
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpackProduct, Third Party Advisory
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpublishProduct, Third Party Advisory
• https://github.com/npm/npm-packlistProduct, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220722-0007/Third Party Advisory
• https://github.com/nodejs/node/pull/43210Patch, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v16.15.1Release Notes, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v17.9.1Release Notes, Third Party Advisory
• https://github.com/nodejs/node/releases/tag/v18.3.0Release Notes, Third Party Advisory
• https://github.com/npm/cli/releases/tag/v8.11.0Release Notes, Third Party Advisory
• https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52Third Party Advisory
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpackProduct, Third Party Advisory
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpublishProduct, Third Party Advisory
• https://github.com/npm/npm-packlistProduct, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220722-0007/Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29238Jupyter Notebook is a web-based notebook environment for int…4.3
• CVE-2022-2924Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4
• CVE-2022-29240Scylla is a real-time big data database that is API-compatib…8.1
• CVE-2022-29241Jupyter Server provides the backend (i.e. the core services,…8.8
• CVE-2022-29242GOST engine is a reference implementation of the Russian GOS…7.5
• CVE-2022-29243Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-29245SSH.NET is a Secure Shell (SSH) library for .NET. In version…5.9
• CVE-2022-29246Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2022-29247Electron is a framework for writing cross-platform desktop a…9.8
• CVE-2022-29248Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 …8.1
• CVE-2022-29249JavaEZ is a library that adds new functions to make Java eas…7.5
• CVE-2022-2925Cross-site Scripting (XSS) - Stored in GitHub repository app…5.4