[GHSA-8r6j-v8pm-fqw3] Code injection in fsevents

[Wenxin-Jiang]

Updates

• Affected products

Comments
The entire vulnerability surface — node-pre-gyp fetching a prebuilt native binary from an S3 bucket at install time — was introduced in 1.0.0.

All 15 0.x versions (0.1.1, 0.1.3–0.1.6, 0.2.0, 0.3.0–0.3.8) compile the native addon locally via node-gyp and load it through require('./build/Release/fswatch') (0.1.x) or require('./build/Release/fse') (0.2.x/0.3.x).

They declare:

• no node-pre-gyp dependency
• no binary.host field
• no reference to fsevents-binaries.s3-us-west-2.amazonaws.com

So the S3-hijack / tarball-substitution class of attack covered by this advisory cannot apply to them.

1.0.0’s package.json is the first to add:

• "node-pre-gyp" as a dependency
• the install script node-pre-gyp install --fallback-to-build
• the binary.host S3 URL

So the introduced version should be 1.0.0, not 0.0.0.