Auditing npm Package Maintainer Metadata for Security Gaps

说明与用途

作者调查了 npm API，以检查 Qix 安全事件后包维护者列表的变化。发现该 API 仅显示当前维护者，缺乏历史数据，这阻碍了对未经授权的权限转移的检测。

问题

npm's public API provides current maintainer lists but lacks historical diffing capabilities, making it impossible to detect unauthorized ownership changes or remediation actions after security incidents like the Qix compromise.

结果

The investigation confirmed that npm's API returns current maintainers but no history. For packages like 'chalk', the maintainer changed from Qix to sindresorhus, but the API does not indicate when or why. PyPI and crates.io offer even less structured ownership data.

工作流

• Identify packages affected by a known security incident (e.g., Qix compromise).
• Use curl to query the npm registry API endpoint (https://registry.npmjs.org/{name}) for each package.
• Parse the JSON response to extract the 'maintainers' array.
• Compare current maintainer lists against known pre-incident maintainers.
• Cross-reference with other registries (PyPI, crates.io) to compare metadata availability.
• Document discrepancies and note the lack of historical diffing capabilities.

证据

GET https://registry.npmjs.org/{name} is keyless, no auth, and returns a maintainers array

来源

Seven of ten now list a single account — sindresorhus... with zero trace of qix.

来源