CVE-2022-29244: npm - Packing does not respect root-level ignore files in workspaces
Summary
CVE-2022-29244: Packing does not respect root-level ignore files in workspaces. Affects npm versions >= 7.9.0, < 8.11.0. Fixed in 8.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a package manager for the JavaScript programming language. It allows developers to easily install, manage, and share code packages. Workspaces are a feature in npm that enable developers to manage multiple packages within a single top-level, root package. This vulnerability affects npm versions 7.9.0 to 8.10.0 and can result in unintended files being included when using the npm pack or npm publish commands with workspaces.
Vulnerability Detail
The vulnerability arises from the fact that when running npm pack or npm publish with workspaces, the root-level .gitignore and .npmignore files are ignored. This means that files that should be excluded according to these ignore files may be included in the package that is published to the npm registry. This can lead to the inclusion of sensitive information or unintended files in the published package, potentially exposing them to unauthorized access.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.11.0
This is the first release that contains the fix.
npm install npm@8.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, developers can manually review the package contents before publishing by running npm pack --workspace=<name> and checking the output in the terminal or using the command tar -tvf <package-on-disk>. If any unexpected files are found, a new release should be created excluding those files, and the old package should be deprecated. Additionally, any sensitive information that may have been exposed should be revoked or rotated.
Conclusion
In conclusion, the npm vulnerability CVE-2022-29244 allows unintended files to be included in published packages when using workspaces. This can result in the exposure of sensitive information or the inclusion of files that were not intended to be shared. To mitigate this vulnerability, it is recommended to upgrade to the latest patched version of npm and review the root-level ignore files to ensure proper exclusion of files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
Versions 7.9.0 to 8.10.0 of npm are affected by this vulnerability.
The impact of this vulnerability is that unintended files may be included in the published package, potentially exposing sensitive information or including files that were not intended to be shared.
You can check if your project is affected by running npm publish --dry-run or npm pack with an npm version >=7.9.0 and <8.11.0 inside the project's root directory using a workspace flag like --workspaces or --workspace=<name>. Check the output in the terminal or use the command tar -tvf <package-on-disk> to see the package contents.
If you find that your package includes unintended files, you should create and publish a new release excluding those files. You should also deprecate the old package and revoke or rotate any sensitive information that may have been exposed.
Yes, Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched version of npm.
References
Related vulnerabilities
Recent vulnerabilities recorded for npm.
