Security researchers recently uncovered a critical vulnerability in Node.js’s continuous integration infrastructure that allowed attackers to execute malicious code on internal Jenkins agents, potentially leading to a devastating supply chain attack. Even more concerning, Node.js’s internal investigation revealed that a similar vulnerability existed in their “commit-queue” process, which could have allowed attackers to inject malicious code directly into the main branch, potentially enabling a supply chain attack affecting all Node.js users. The vulnerability allowed attackers to bypass security checks and execute arbitrary code on internal Jenkins agents that build and test the world’s most popular JavaScript runtime environment. “The core issue stems from a Time-of-Check-Time-of-Use (TOCTOU) vulnerability between initiating a CI build and the moment the Jenkins job checks out the code,” explained Node.js’s Technical Steering Committee in their disclosure. Security firm Praetorian revealed on April 30, 2025, that they had discovered serious security gaps in Node.js’s CI/CD pipeline architecture. The Node.js team has earned praise for their transparent handling of the incident and comprehensive remediation efforts, demonstrating a commitment to security that sets an example for open-source projects worldwide.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 01 May 2025 05:45:08 +0000