Attributed metadata history

Dataform cross-tenant path traversal

Dataform could have allowed a malicious customer to gain unauthorized cross-tenant access to other customer's code repositories and data. By preparing a maliciously crafted package.json file, an attacker could exploit a path traversal vulnerability in the npm package installation process, thereby gaining read and write access in other customers' repositories. According to Google, there was no evidence of exploitation in the wild.

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.