Skip to content

Restrict NPM package file types

Problem

A user could use the NPM upload endpoints to upload files of any type. This presents an unnecessary security vulnerability.

Solution

We should restrict files uploaded to this endpoint to only allow for .tgz files. It should be checked that .tgz are the only file types NPM allows and update to include any other filetypes that may be allowed.

References

Investigation of package limits