NODE_PATH environment variable

NODE_PATH adds directories to the module resolution search path. Point it at a directory containing a module name your app imports, and Node may resolve that import to the attacker-controlled module first.

mkdir -p /tmp/evil-modules/left-pad
echo 'module.exports = { pwned: true }' > /tmp/evil-modules/left-pad/index.js
NODE_PATH=/tmp/evil-modules node -e "console.log(require('left-pad'))"

Attackers use NODE_PATH less often than NODE_OPTIONS. It only shadows non-relative requires, and core modules resolve first, which limits the impact in modern setups. Older versions, specific configurations and loosely managed CI/CD environments are still at risk, so it's worth knowing about.