npm CLI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz High (npm CLI asset capped at High severity, critical unreachable) │ $5,000 │ $6,000 Medium │ $2,000 │ $2,500 Low │ $250 │ $313 Submit a vulnerability CVE history 1 Last 12 months 12 Lifetime Injection 30 % Access control 25 % Info disclosure 25 % Parsing/validation 15 % Latest advisories Loading the feed Overview The npm CLI ships inside the official Node.js distribution, which means it is installed wherever Node.js is installed: every JavaScript developer machine, every Node container image and essentially every CI runner in the JavaScript world. It is the single most-executed supply-chain entry point in software, and the 2025-2026 wave of self-replicating npm worms turned lifecycle-script and lockfile handling in this exact codebase from a plumbing detail into a first-order security surface. GitHub pays it by name on one of the oldest continuously running programs on HackerOne, though the CLI asset is capped at high severity, so the ladder runs $250 for low, $2,000 for medium and $5,000 at the top rather than reaching the program's $10,000 critical cell. A second and larger pathway exists outside the bounty: github.com/npm/cli is named in Google Patch Rewards Tier 1 at up to $15,000 for a merged upstream patch. sorona.xyz adds 1.25x on top of whatever GitHub awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~4 days First response ~11 days Triage ~44 days Bounty In scope GitHub lists npm CLI as its own downloadable-executable asset, bounty-eligible with a maximum severity of high. The row names the shipped command-line client and carries no list of eligible bug shapes, so the client's own code is the target The install path in full: dependency resolution, package-lock.json and npm-shrinkwrap.json handling, the arborist tree build, and the node_modules layout it produces Package fetching and tarball extraction through the pacote and tar paths, in particular path traversal and symlink handling on unpack Registry authentication and credential storage in .npmrc , covering scoped registries, auth tokens, and the decision about which host a credential is sent to Lifecycle-script execution around preinstall , install and postinstall , where the client hands control to code the package author supplied Manifest and semver parsing, where a crafted version range or manifest field is read one way by the resolver and another way by everything downstream The rest of the command surface: npm audit , npm publish , npm pack , npm exec and npx , npm config , and the workspace commands Out of scope The npmjs.com registry service itself, which is a separate GitHub asset from the command-line client and carries its own higher severity cap Third-party packages published to the registry, which are the responsibility of the package authors rather than of npm Electron and Atom, which sit in the same GitHub scope table explicitly marked as not eligible for bounty Findings that require a maintainer to merge malicious code before they work Critical-severity impact claims, since the CLI asset's maximum severity is high and the critical cell cannot be awarded here Awards are gated on sanctions screening, so a reporter who cannot clear it will not be paid Most-valued findings Injection into lifecycle-script execution that runs attacker code on npm install without the user opting into anything, the top-paying shape on this asset Tarball extraction path traversal or symlink handling that writes a file outside the intended package directory Credential and token leakage out of .npmrc or the registry auth flow to a host the user never configured Lockfile or manifest parsing confusion where the resolver installs something other than what the lockfile appears to pin Access-control gaps in npm publish that let one account affect a package it does not own Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Keep all information about the report on HackerOne, and do not post it to video-sharing or pastebin sites The finding has to live in the CLI itself; the npmjs.com registry is a separate GitHub asset with its own, higher, severity cap Critical-band impact is not payable on this asset, because the npm CLI scope row carries a maximum severity of high Findings that only work if a maintainer merges malicious code are not eligible, since that is a trust decision rather than a defect Third-party packages published to the registry belong to their authors, not to this program Program stats 2,132 Reports resolved $6.5M Bounties paid 62% Response efficiency Disclosure Coordinated through GitHub on HackerOne, and GitHub's rules require every detail of the report to stay on the platform while it is open. Because that clause can be read as covering a sorona.xyz-routed report, file with GitHub directly first and keep the discussion there; sorona.xyz holds anything you share with us until GitHub has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability