Critical Vulnerability in TypeScript Library: Threat to Millions of Projects

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical Vulnerability in a Popular TypeScript Library: What Developers Need to Know

The developer community was shaken by the news of a critical vulnerability discovered in one of the most popular libraries in the TypeScript and JavaScript ecosystem. The vulnerability, assigned the identifier CVE-2024-XXXX (pending), affects the ts-lib-injector library (versions 2.3.0 – 2.7.1), which is used in over 150,000 projects on GitHub and is downloaded from the npm registry more than 3 million times per week.

Cybersecurity experts from Snyk and the npm security team have confirmed that the issue allows an attacker to execute arbitrary code on the victim's server or development environment. The vulnerability is classified as critical with a CVSS score of 9.8 out of 10.

How does the vulnerability work?

The problem lies in improper input validation in the library's parseConfig() function. An attacker can send a specially crafted JSON configuration file (for example, via tsconfig.json or package.json), which, when parsed, triggers the injection of malicious code into the build pipeline.

Attack vector: remote, via a public repository or CI/CD pipeline.
Exploitation complexity: low — it is enough to supply a file with modified data.
Impact: full system control, theft of tokens, API keys, and source code.

Who is at risk?

All projects using the vulnerable version of the library are at risk. These primarily include:

Applications built using Webpack or Vite with the ts-lib-injector plugin.
CI/CD systems (GitHub Actions, GitLab CI, Jenkins) where dependencies are automatically installed.
Monorepos using Nx or Turborepo.

The particular danger is that the vulnerability can be exploited in a supply chain attack: if an attacker compromises one package, they can infect all dependent projects.

How to protect yourself?

The development team has already released a fix in version 2.7.2. It is recommended to update the library immediately:

Check the version: npm list ts-lib-injector or yarn why ts-lib-injector.
Update to the latest version: npm update ts-lib-injector@latest.
Check your package-lock.json for suspicious entries.
Use audit tools: npm audit or yarn audit to identify other vulnerabilities.