CVE-2024-37150: 
NixOS vulnerability analysis and mitigation

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain, including usage of deno install subcommand, auto-install for npm: specifiers and LSP usage (Deno Advisory).

The vulnerability occurs when Deno only considers the first URL of the registry to get credentials instead of the tarball URL. For example, if a package is at https://registry.npmjs.org/package-name, Deno would send the credentials for https://registry.npmjs.org/ to whatever the tarball URL was, even if it was on a different domain. This behavior is similar to how npm used to work in the past (Deno Advisory). The vulnerability has been assigned a CVSS v3.1 score of 7.6 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L (NVD).

The vulnerability could lead to exposure of sensitive credentials to unauthorized domains when downloading npm packages. This is particularly concerning for organizations using private registries that serve tarballs from different domains than the registry itself (Deno Advisory).

The vulnerability can be exploited when a private registry serves package tarballs from a different domain than the registry itself. The attack requires user interaction and network access, but no privileges are required to execute the attack (NVD).

Users are recommended to upgrade to Deno 1.44.1. Additionally, if your private registry ever serves tarballs at a different domain, it is recommended to rotate your registry credentials (Deno Advisory).