Command Injection

The buns npm package (all versions) contains a command injection vulnerability in the install(requestedModule) function at line 678 of lib/index.js. The function fails to sanitize user-supplied input, allowing an attacker to inject arbitrary OS commands.

To exploit, an attacker provides a malicious module name (e.g., "& touch JHU") to the install function. No authentication or special privileges are required; the attack vector is over the network if the function is called with attacker-controlled input. The injected commands are executed in the context of the Node.js process.

Successful exploitation results in arbitrary command execution on the host system, potentially leading to data theft, ransomware, or lateral movement.

As of the advisory publication date, no fixed version exists, and the package appears to be unmaintained. Users should avoid using this package and migrate to alternatives. The vulnerability is publicly known and has a proof-of-concept available [1][2].