This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
ReleasePort's take
Light signalThe release detects malicious node-ipc versions and enforces stricter npm install policies in CI to block unprovenance scripts.
Why it matters: Malicious node‑ipc releases (9.2.2, 10.1.1‑10.1.3, 11.x) can still be pulled transitively; CI workflows now require `--expect-provenance` or `--ignore-scripts` to stop lifecycle‑script execution.
Summary
AI summaryDetection of malicious node-ipc versions and hardening of CI npm installs against provenance‑less supply‑chain attacks.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Flags malicious node-ipc versions (9.2.2, 10.1.1-10.1.3, 11.x) that still resolve transitively in legacy toolchains. Flags malicious node-ipc versions (9.2.2, 10.1.1-10.1.3, 11.x) that still resolve transitively in legacy toolchains. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Security | Medium |
Enforces `npm ci`/`npm install` with `--expect-provenance` or `--ignore-scripts` to prevent lifecycle-script execution in CI workflows. Enforces `npm ci`/`npm install` with `--expect-provenance` or `--ignore-scripts` to prevent lifecycle-script execution in CI workflows. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Refactor | Medium |
Dogfood ci.yml and publish.yml now run `npm ci --ignore-scripts`. Dogfood ci.yml and publish.yml now run `npm ci --ignore-scripts`. Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
- VG1069 node-ipc malicious-version detection — flags the 2022 peacenotwar protestware versions (9.2.2, 10.1.1-10.1.3, 11.x) that still resolve transitively in legacy toolchains
- VG1070 CI npm install/ci without supply-chain hardening — fires on YAML workflows that call
npm ci/npm installwithout--expect-provenanceor--ignore-scripts; mitigates the lifecycle-script execution path the @tanstack Mini Shai-Hulud wave used to reach CI secrets - Dogfood: our own ci.yml and publish.yml now run
npm ci --ignore-scripts
Security Fixes
- VG1069 — Flags malicious node‑ipc versions (9.2.2, 10.1.1‑10.1.3, 11.x) used in peacenotwar protestware.
- VG1070 — CI workflows now require `--expect-provenance` or `--ignore-scripts` for `npm ci`/`npm install` to prevent provenance‑less supply‑chain execution.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Beta — feedback welcome: [email protected]