Claude Code v2.1.248 ·
npm package names are checked for path traversal
npm package names are now rejected if they contain path traversal characters.
Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PluginsArea: what it touches
New FeaturesKind: in v2.1.248,
New FeaturesSection of the release
What
Package names are now validated against a schema that rejects anything containing .. or // and requires a valid scoped or unscoped npm name shape.
Details
- The rejection message is "Package name cannot contain path traversal patterns".
Evidence
Package name cannot contain path traversal patterns
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
See this entry in the whole of v2.1.248 →
