Auditing npm Package Maintainer Metadata for Security Gaps

Описание и применение

Автор исследует API npm, чтобы проверить изменения в списках сопровождающих пакетов после инцидента безопасности с Qix. Выяснилось, что API показывает только текущих сопровождающих, не предоставляя истории изменений, что затрудняет обнаружение несанкционированных передач прав.

Задача

npm's public API provides current maintainer lists but lacks historical diffing capabilities, making it impossible to detect unauthorized ownership changes or remediation actions after security incidents like the Qix compromise.

Результат

The investigation confirmed that npm's API returns current maintainers but no history. For packages like 'chalk', the maintainer changed from Qix to sindresorhus, but the API does not indicate when or why. PyPI and crates.io offer even less structured ownership data.

Рабочий процесс

• Identify packages affected by a known security incident (e.g., Qix compromise).
• Use curl to query the npm registry API endpoint (https://registry.npmjs.org/{name}) for each package.
• Parse the JSON response to extract the 'maintainers' array.
• Compare current maintainer lists against known pre-incident maintainers.
• Cross-reference with other registries (PyPI, crates.io) to compare metadata availability.
• Document discrepancies and note the lack of historical diffing capabilities.

Доказательства

GET https://registry.npmjs.org/{name} is keyless, no auth, and returns a maintainers array

Источник

Seven of ten now list a single account — sindresorhus... with zero trace of qix.

Источник