# Arbitrary package tampering in Deno registry + Code Injection in encoding/yaml

Unsanitized subdir in deno.land/x registry allowed path traversal to read /proc/self/environ, leaking AWS S3 credentials for arbitrary package tampering; plus YAML function code injection.

- Payout: Research
- Severity: critical
- Program: Deno
- Write-up by: RyotaK
- Disclosed: 2021-11-30
- CVE: CVE-2021-42139
- Write-up quality: 8/10
- Original: https://blog.ryotak.net/post/deno-registry-tampering-with-arbitrary-packages-en/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-deno-registry-tampering-with-arbitrary-packages-en
- Tags: area:web3 domain:web3 impact:data-leak impact:integrity kind:research platform:research sev:critical tech:nodejs technique:chained technique:source-review vuln:path-traversal vuln:rce vuln:secrets-leak

**Target:** deno.land/x registry upload API (subdir param) and deno_std encoding/yaml EXTENDED_SCHEMA
**Root cause:** The subdir parameter is joined to clonePath without normalization, so traversal sequences escape the repo root; walk() then enumerates and uploads arbitrary files to public S3. Separately, reconstructFunction uses new Function() on YAML !!js/function values.
**Steps:**
1. Send module upload request with `subdir=../../../../../../../proc/self`
2. Registry joins subdir to clonePath and walk() enumerates /proc/self files
3. Files are read and passed to uploadVersionRaw, uploaded to S3 with public-read
4. Fetch uploaded /proc/self/environ from S3 to obtain AWS credentials
5. Use leaked credentials to overwrite module files in S3 buckets (package tampering)
6. For YAML: parse untrusted YAML with `{ schema: EXTENDED_SCHEMA }` containing `!!js/function > function(){...}` to execute code via new Function
**How found:** Read Deno's 'secure runtime' claim, scoped review to deno, deno_std, deno_registry2; noticed subdir concatenated to clonePath without sanitization and traced it into walk() and S3 upload.
**Exploitation:** Attacker controls subdir on the GitHub-release auto-update upload path; traversal to /proc/self causes environment variables (AWS keys) to be uploaded as a public S3 object, which the attacker downloads and uses to tamper arbitrary packages hosted on deno.land/x.
**Escalation:** Path traversal file read chained to credential theft, then to supply-chain tampering of all hosted modules.
**Insight:** In upload/publish pipelines, trace user-supplied path prefixes through join() into directory walkers and storage uploads — a traversal there turns into public disclosure of secrets like /proc/self/environ rather than a simple file read.