Improper Integrity Checks Affecting yarn package, versions <1.19



    Attack Complexity Low
    User Interaction Required
    Scope Changed
    Confidentiality High
    Integrity High
    Availability High
Expand this section
5.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-YARN-557182
  • published 26 Feb 2020
  • disclosed 26 Feb 2020
  • credit chalker

How to fix?

Upgrade yarn to version 1.19 or higher.


yarn is a package for dependency management.

Affected versions of this package are vulnerable to Improper Integrity Checks. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake version (regardless of integrity and hashes).