What’s Vulnerable › Vulnerabilities

CVE-2022-29244: npm packing does not respect root-level ignore files in workspaces

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-13 · updated 2026-06-17
• Weakness: CWE-200

Description

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

Affected products

• NetApp ONTAP Select Deploy administration utility: all versions
• Npmjs Npm: from 7.9.0 before 8.11.0 — fixed in 8.11.0

How to fix

Upgrade to a fixed version: Npmjs Npm 8.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/nodejs/node/pull/43210
• https://github.com/nodejs/node/releases/tag/v16.15.1
• https://github.com/nodejs/node/releases/tag/v17.9.1
• https://github.com/nodejs/node/releases/tag/v18.3.0
• https://github.com/npm/cli/releases/tag/v8.11.0
• https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpack
• https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish
• https://github.com/npm/npm-packlist
• https://security.netapp.com/advisory/ntap-20220722-0007/
• https://github.com/nodejs/node/pull/43210
• https://github.com/nodejs/node/releases/tag/v16.15.1

Get alerted when CVE-2022-29244 or the next vulnerability affects your stack