# Supply Chain Pollution: Hunting a 16 Million Download/Week npm Package Vulnerability for a CTF Challenge

The npm 'ini' parser (16M downloads/week) lacked a key blacklist, so a config file with a [__proto__] section polluted Object.prototype, enabling prototype pollution.

- Payout: Research
- Severity: high
- Program: ini
- Write-up by: Eugene Lim
- Disclosed: 2020-12-23
- Write-up quality: 6/10
- Original: https://spaceraccoon.dev/supply-chain-pollution-hunting-a-16-million-download-week-npm-package/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-supply-chain-pollution-hunting-a-16-million-download-week-npm-package
- Tags: area:oss domain:oss impact:integrity kind:research platform:research sev:high tech:nodejs technique:recon technique:source-review vuln:prototype-pollution

**Target:** npm package 'ini' INI config parser
**Root cause:** The INI parser assigned parsed section names as object keys without blacklisting __proto__/prototype/constructor, so a [__proto__] section wrote onto Object.prototype.
**Steps:**
1. Search npm/GitHub for dotted-path and config-file parsers (grep.app regex `key.split('.')`, npm keywords:toml/ini).
2. Identify packages that set nested object keys from parsed input without a disallowed-keys blacklist.
3. Craft payload INI: `[__proto__]` newline `polluted = "polluted"`.
4. Run `iniParser.parse(fs.readFileSync('./payload.ini','utf-8'))`.
5. Observe `{}.polluted === 'polluted'` confirming prototype pollution.
**How found:** Studied the dot-prop patch (blacklist of __proto__/prototype/constructor) and reasoned that the vulnerability is the absence of a blacklist in any dotted-path/config parser; then used grep.app regex for `key.split('.')` and npm keyword search to enumerate parsers, testing each with a PoC at scale.
**Exploitation:** Attacker supplies a malicious INI config file to any application using the vulnerable ini parser; the [__proto__] section pollutes Object.prototype, and impact depends on downstream gadgets (e.g. chaining with a templating engine RCE gadget as in the CTF challenge).
**Escalation:** Chain prototype pollution with an application gadget (templating engine) to escalate to remote code execution, as demonstrated in the referenced CTF challenge write-up.
**Insight:** For unsafe-by-default functionality (dotted-path setters, config parsers), hunt by the absence of a blacklist rather than a vulnerable code pattern: search for `split('.')`/nested-key assignment and test with a `[__proto__]` payload; npm keyword search enumerates whole package categories.