CVE-2013-4116: Node Packaged Modules Project Node Packaged Modules

Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days.

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

Affected products

• Node Packaged Modules Project Node Packaged Modules: before 1.3.3 (fixed in 1.3.3)

Published 2014-04-22. Last modified 2026-06-16.