Read the researcher's report on HackerOne
The report describes a dependency-confusion issue: internal Node.js package references were available to claim on the public package registry. The report does not detail execution evidence or impact beyond the stated proof of concept.
How it was found
- The researcher identified references to internal library packages.
- They checked whether those package names were available on the public registry.
- They claimed package names and supplied proof-of-concept code.
- Access needed
- No account
- User interaction
- Not clear
- Whose object
- No object involved
- Boundary crossed
- Public package publication could influence installation of an internally referenced library.
- Root cause
- Package installation configuration allowed public-registry packages to satisfy references intended for internal libraries.
- Impact
- A public package could potentially execute attacker-controlled code during installation in an affected environment.
- Payload class
- malicious package installation code
- Components
- Node.js dependency management, package registry
- Confidence
- medium
Dependency confusion / supply chainCode injection / eval
This analysis is CyberSIXT's own summary of the public report, written by a model and checked automatically. It may be wrong: the researcher's report is the source. Written 2026-11-14. Ask for a correction or removal.
| Report | Access | Whose object | Boundary crossed |
|---|---|---|---|
| Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registry | No account | No object involved | Package resolution trusted a public-registry package in place of an internal dependency during builds. |
| RCE via npm misconfig -- installing internal libraries from the public registry | No account | No object involved | Public package registry supply crossed into internal development dependency resolution. |
| Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application | A user account | No object involved | A website crossed from browser-origin access into control of a local desktop application and execution on the host. |
| RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/ | No account | No object involved | Unauthenticated internet access crossed the proxy boundary to an internal JBoss console and server. |
| Remote Code Execution in Slack desktop apps + bonus | A user account | The attacker's own | A user click navigated from Slack content to attacker-controlled code with desktop-app privileges. |
| RCE when removing metadata with ExifTool | A user account | No object involved | A user-controlled attachment crossed into server-side metadata processing and achieved code execution on the application host. |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pages | A user account | The attacker's own | A wiki contributor's content crossed into server-side Ruby code execution during rendering. |
| Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect Message | No account | No object involved | A remote game server's kick message crossed into a player's trusted UI and executed script. |
| Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where) | No account | No object involved | An unauthenticated caller's GraphQL input crosses into JavaScript execution in the server process. |
| Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql | A user account | The attacker's own | Caller-controlled sort input crossed into Elasticsearch script execution within the caller’s own search results. |
| Urgent: Server side template injection via Smarty template allows for RCE | A user account | The attacker's own | Profile data crossed into server-side template evaluation, exposing a server file through an invitation email. |
| Unserialize leading to arbitrary PHP function invoke | Not clear from the report | No object involved | Untrusted input crossed into PHP function execution. |