CVE-2016-3956

What it actually does

The npm CLI leaks bearer authentication tokens by including Authorization headers on HTTP requests sent to arbitrary remote servers instead of restricting them to trusted registries.

Why it matters to the business

Organizations risk exposure of npm authentication credentials, enabling attackers to access private packages, publish malicious updates, or compromise software supply chains.

How an attack unfolds

An attacker hosts a malicious HTTP server reachable during package operations; when a vulnerable npm client performs any request, the bearer token is sent in the Authorization header, allowing the attacker to capture and reuse the credential.

How to fix it

Upgrade npm to version 2.15.1 or later, or 3.8.3 or later; for source builds apply commit f67ecad59e99a03e5aad8e93cd1a086ae087cb29.

How to confirm the fix worked

Verify the installed npm version meets or exceeds the fixed releases and confirm that Authorization headers are no longer sent to untrusted hosts during test requests.

Typical attack path

1. Attacker registers or compromises a domain or package that triggers an outbound HTTP request from npm
2. Victim runs an npm command such as install or publish against a configuration that reaches the attacker's server
3. npm client attaches the stored bearer token to the request
4. Attacker extracts the token from the received Authorization header and uses it for unauthorized registry actions

How to detect it

Review proxy, firewall, or endpoint logs for npm processes making outbound HTTP requests to unexpected domains while carrying Authorization headers; examine shell history and npm debug logs for unusual registry interactions.

What your security team should do

• Immediately upgrade all npm installations to a fixed version
• Rotate any npm bearer tokens that may have been exposed
• Audit package.json and .npmrc files for unexpected registry URLs
• Monitor network logs for npm processes contacting unknown domains