16105 2025-12-17 16:35:30 +0000 NPM fetcher is insecure 2026-09-29 08:19:37 +0000 1 1 7 Build System, Metadata & Runtime BitBake bitbake unspecified x86 Multiple RESOLVED FIXED Medium+ normal 6.99 15551 15607 1 paul thomas.perrot ccasciato contact mathieu.dubois-briand pavel poky.bs.watcher poky.watcher pokylinux randy.macleod ross.burton thomas.perrot --- --- Don't know oldest_to_newest 103584 0 paul 2025-12-17 16:35:30 +0000 The NPM fetcher is being disabled as it is insecure. To re-enable this, we need the security issues to be resolved *AND* tests to be added. The NPM fetcher gets the checksum for each source from the remote registry. This contradicts our usual policy of storing checksums in the recipe so that we can ensure that the remote file has not been altered. If the remote is in charge of both the checksum and the source contents, we can't detect tampering from a compromised NPM registry. 103596 1 randy.macleod 2025-12-18 15:52:23 +0000 Richard to disable for M1. Then lower to medium, 60 priority and unassigned. We need help from npm users here. 103735 2 paul 2026-01-07 14:39:14 +0000 If we need something to test with, there are recipes on the master branch of meta-luneos (https://layers.openembedded.org/layerindex/branch/master/layer/meta-luneos/) which use npm:// and npmsw:// SRC_URIs. 104054 3 richard.purdie 2026-01-23 12:01:07 +0000 NPM fetcher has been disabled: https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Reclassifiy the bug as a medium+ unassigned as a result. 104325 4 contact 2026-02-16 17:28:31 +0000 There are multiple package managers for JS that can use the same registries, I'm thinking that there's some sort of standard API, I'll look it up and see what other fetches do and I'll try to implement something. Not sure what npmsw does, but the npm fetcher doesn't even lock direct dependencies, meaning that you will end up with different dependencies once those dependencies have new releases. 105758 5 thomas.perrot 2026-06-05 11:03:16 +0000 Hello, I propose to discard any checksum obtained from the registry and instead require the recipe author to supply the checksum directly in SRC_URI (sha512sum=, sha256sum=). The .resolved cache file would then store only the bare tarball URL. Kind regard, Thomas 106050 6 thomas.perrot 2026-06-30 12:41:35 +0000 I submitted a patch series: https://lore.kernel.org/all/20260616-dev-tprrt-fix-npm-v1-0-6fde95bf0a8b@bootlin.com/ 106570 7 mathieu.dubois-briand 2026-08-20 12:36:26 +0000 Patches got merged: https://git.openembedded.org/bitbake/commit/?id=f7608f3195af9abb405af9be95286e2267221331 https://git.openembedded.org/bitbake/commit/?id=9e45e00a2009f28829417c9517f5ab623f66dd5d https://git.openembedded.org/bitbake/commit/?id=355cd226e0720a9ed7683bb01c8c0a58eee03664 Paul, Thomas: can we close this bug entry? 106956 8 paul 2026-09-29 08:19:37 +0000 This has been resolved by the commits Mathieu linked to above. Further hardening of the npm fetcher is likely possible but that's a job for another bug.