Technical impact
A flaw in the shelljs.exec function within the check‑peer‑dependencies npm package permits an attacker to inject arbitrary operating‑system commands. The vulnerability is an OS Command Injection weakness catalogued as CWE‑77 and CWE‑78. When triggered the underlying node process can execute arbitrary commands, potentially allowing full compromise of the host system’s confidentiality, integrity, and availability.
Affected Systems
The check‑peer‑dependencies npm package, authored by christopherthielen, is affected in all releases up to and including version 4.3.4. Any JavaScript or Node.js project that imports this package to perform peer‑dependency checks—common in build pipelines, continuous integration tools, and local development setups—is at risk.
Risk and Exploitability
The CVSS score of 5.3 indicates medium severity, while the EPSS score of 1% reflects a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, most often through a publicly accessible npm registry or by an attacker who can influence the contents of a dependency installation, such as via a compromised npm package source or a malicious commit that pulls in a vulnerable version of check‑peer‑dependencies.
