[Security] Injecting code in yarn-*.cjs

[hexnickk]

By default, yarn2 needs to store a .cjs file in the project repo, the issue is that a malicious user can update this file to the latest version(e.g. 3.1.0 -> 3.1.1) and inject any code into it. Even worse, GitHub won't even show the diff between versions.

So I've updated local yarn version to the latest, added console log to the start and opened PR to check how it looks.

Now, every time I do yarn it will execute code I've pasted before.

➜  yarn2 git:(feat/yarn2-up) yarn
hello world
➤ YN0000: ┌ Resolution step
➤ YN0000: └ Completed
➤ YN0000: ┌ Fetch step
➤ YN0000: └ Completed
➤ YN0000: ┌ Link step
➤ YN0000: └ Completed
➤ YN0000: Done in 0s 128ms

Can original yarn package at least verify the checksum of this file before running it?

cc @ai

[arcanis]

Can original yarn package at least verify the checksum of this file before running it?

Against what?

Even worse, GitHub won't even show the diff between versions.

That should be filled against GitHub; they certainly should improve their interface and better surface "dangerous" changes.

[hexnickk]

Against what?

Is this file unique for each user?

That should be filled against GitHub; they certainly should improve their interface and better surface "dangerous" changes.

But the actual file is minified, so it won't do any good if GitHub will allow exploring this file, regular user won't ever notice some extra code inserted somewhere in between.

[arcanis]

But the actual file is minified, so it won't do any good if GitHub will allow exploring this file, regular user won't ever notice some extra code inserted somewhere in between.

True (although seeing random changes in a minified file should always raise suspicion and generally prevent a PR from being merged). In general anyway we're moving towards Corepack for distributing Yarn, which should make this problem moot.

[hexnickk]

In general anyway we're moving towards Corepack for distributing Yarn, which should make this problem moot.

Sounds good! Can we at least do some warning section in documentation for OSS maintainers about this? It may sound a bit obvious, but probably not all maintainers knows, that merging big diffs may be bad. But yeah, I understand, it isn't actually about yarn, but more about general security considerations.