{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/better-npm-audit-3.11.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-57998"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["better-npm-audit (3.11.0)","better-npm-audit (4.0.0-rc.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe better-npm-audit package (versions through 3.11.0 and 4.0.0-rc.2) contains a critical command injection vulnerability identified as CVE-2026-57998. The vulnerability originates in src/handlers/handleInput.ts, where user-supplied input provided via the --registry command-line option is directly interpolated into a command string without sufficient validation or quoting. This string is subsequently passed to child_process.exec() in index.ts, which triggers a shell-based execution context. By supplying shell metacharacters such as semicolons, pipes, or command substitution sequences, an attacker can execute arbitrary operating system commands. The injected commands run with the privileges of the user executing the audit process, which may include build agents or developer environments, posing a significant risk to CI/CD pipelines and local workstations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution in the context of the user or process running the better-npm-audit tool. This can lead to full compromise of the local environment, exfiltration of credentials or source code, and persistent access to CI/CD systems, potentially facilitating supply chain compromise if injected into automated pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade better-npm-audit to a patched version that sanitizes the --registry input or switches from child_process.exec() to child_process.execFile() to avoid shell interpretation.\u003c/li\u003e\n\u003cli\u003eAudit build logs and automated CI/CD pipeline configurations to detect suspicious usage of the --registry parameter containing shell metacharacters like \u0026quot;;\u0026quot;, \u0026quot;|\u0026quot;, \u0026quot;\u0026amp;\u0026quot;, or \u0026quot;$\u0026quot;.\u003c/li\u003e\n\u003cli\u003eLimit the privileges of service accounts running audit tools in CI/CD environments to minimize the impact of successful command injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-22T13:30:26Z","date_published":"2026-08-22T13:30:26Z","id":"https://feed.craftedsignal.io/briefs/2026-08-better-npm-audit-injection/","summary":"The better-npm-audit package is vulnerable to arbitrary command injection via improper sanitization of the --registry command-line argument when passed to a shell execution context.","title":"Command Injection in better-npm-audit via --registry Parameter","url":"https://feed.craftedsignal.io/briefs/2026-08-better-npm-audit-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Better-Npm-Audit (3.11.0)","version":"https://jsonfeed.org/version/1.1"}