# Claiming package names in GitLab's automatic package referencer.

GitLab auto-linked unpublished package.json names to npmjs.com, letting an attacker register the name and serve a malicious installable package from a trusted project page.

- Payout: $1,000
- Severity: low
- Program: GitLab
- Credited: edoverflow
- Disclosed: 2019-04-05
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/462503
- Library page: https://bugbountylibrary.com/r/h1%3A462503
- Tags: domain:web impact:ato impact:integrity kind:bounty platform:hackerone sev:low tech:nodejs technique:recon vuln:business-logic vuln:misconfiguration

**Target:** GitLab repository file viewer package referencer (package.json npm linking)
**Root cause:** GitLab assumes any package name in package.json without a GitLab homepage was published to the public npm registry, and links to it unconditionally.
**Steps:**
1. Find a GitLab project with a package.json declaring a package name never published to npm (e.g. gitter-desktop in gitlab-org/gitter/desktop).
2. Register that exact name on npmjs.com with a malicious package containing install scripts.
3. Visit the package.json blob page; GitLab renders a link to https://www.npmjs.com/package/<name>.
4. Victim clicks the trusted-looking link and installs the package, executing npm install scripts.
**How found:** Researcher noticed GitLab assumes packages are published to npm by default when no GitLab homepage key exists, and observed many local-only packages (e.g. Facebook projects) that were never published; tested by claiming one of GitLab's own package names.
**Exploitation:** Attacker claims the unpublished package name on npm with a malicious module whose install scripts execute on install; GitLab's auto-generated link from the trusted project page drives victims to it.
**Escalation:** Claiming many such names across projects could be automated to scale the hijack.
**Insight:** Auto-generated registry links from manifest files are an attack surface: any declared-but-unpublished package name is claimable by an attacker and inherits the host project's trust.