Npm Check Updates
Monthly
Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.
Terminal escape sequence injection in npm-check-updates through 23.0.2 enables a supply-chain attacker who controls a malicious npm package's metadata to embed arbitrary VT100/OSC control sequences in the `homepage` or `repository` URL fields of `package.json`. When developers run `ncu --format homepage` or `--format repo`, these unfiltered sequences are written directly to the terminal, allowing output overwriting via bare carriage returns, terminal title hijacking via OSC sequences, and other display manipulation on developer workstations or CI runners. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the fix PR's test suite demonstrates the exact attack pattern using OSC title-setting sequences and CR overwrites.