Submitted by ch13fd357r0y3r
I discovered an npm package and the scope of the package is unclaimed on the NPM website. This will give any User to claim that package and be able to Upload a Malicious Code under that unclaimed package. This results in achieving the Remote code execution on developers/users machine who depends on the timeswap repository to build it on local env.
Vulnerable Package Name: @timeswap-labs/timeswap-v1-core
Till now The Package is not claimed on NPM Registry, but its vulnerable to dependency confusion.
You can read more dependency confusion here: https://dhiyaneshgeek.github.io/web/security/2021/09/04/dependency-confusion/
Claim the Scope name called timeswap-labs by following the above POC Step 1.
amateur-dev (Timeswap) confirmed and commented:
0xleastwood (judge) commented:
For this contest, 10 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by hyh received the top score from the judge.
The following wardens also submitted reports: gzeon, Dravee, 0x1f8b, WatchPug, cryptphi, peritoflores, robee, rfa, and kenta.
