Closes #64 Pre-fix, nodeup-npm/scripts/install.js followed the GitHub-releases redirect from github.com to objects.githubusercontent.com with zero validation, then trusted whatever bytes came back: any host in the Location header would be GET'd, and its bytes chmod 755'd into ./bin/nodeup. A TLS-stripping proxy, a compromised CDN bucket, a DNS-poisoned resolver, or a corrupt mirror could swap in an attacker-controlled binary and the user would have no way to know. This commit closes the integrity gap before extraction: - followHops(startUrl, hopsLeft, acceptStatus) walks the redirect chain while validating every Location header against ALLOWED_REDIRECT_HOSTS (Set(['objects.githubusercontent.com'])). Any off-CDN target aborts the install with the offending hostname named. MAX_REDIRECT_HOPS = 2 bounds the walker at the known GitHub chain length. - fetchExpectedHash(repo, tag, archiveName) downloads the release's checksums.txt first (fail fast — no point pulling an archive we can't verify) and parses out the expected SHA256 for our exact archive basename via parseChecksumsTxt. The parser accepts both GoReleaser's two-space shape and sha256sum -b / --tag's binary- mode * shape, with or without space between * and the filename. - downloadTo(url, destPath) streams the archive to disk while piping it through crypto.createHash('sha256') — the hash is computed as bytes arrive, no second pass over the file. On mismatch, the half-saved archive is unlinkSync'd before die() runs, so a forensic investigation of the failing install doesn't leave the (potentially attacker-controlled) bytes sitting in tmp. - nodeup-npm/scripts/install_test.js: 12 pure-helper smoke tests covering parseChecksumsTxt (two-space, binary-mode-*, malformed- line skipping, basename keying), followHops (allowlisted redirect, off-CDN redirect rejection, hop-count ceiling, missing- Location-header rejection, unexpected-status rejection), and end-to-end integrity (missing-archive-in-checksums error names the offender + available set, hash mismatch is detected, streaming hash equals direct hash). No JS test framework — same reasoning as the tar runtime-dep fix in #63. CHANGELOG: ### Fixed entry under [Unreleased] documents the redirect allowlist, the SHA256 stream-while-downloading pattern, and the unlink-on-mismatch cleanup. Co-Authored-By: puku-ai-2.8 <noreply@puku.sh>

Commits

Commits on Jul 3, 2026

fix(deps): verify npm-wrapper binary download against release checksums