Threats affecting pkg:npm/@sigstore/sigstore-js

CVE-2026-118763 is a vulnerability in sigstore-js versions prior to 0.7.2 where registry credentials can be leaked to attacker-controlled hosts. The RegistryClient.signIn() method stores authorization headers globally, and RegistryClient.uploadBlob() sends PUT requests to arbitrary blob-upload URLs without verifying their origin. This allows a malicious registry to capture sensitive credentials during artifact pushes. The issue is fixed in version 0.7.2 by isolating registry credentials and restricting their transmission to the registry origin only.

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.