Malicious Package in 4equest
Summary
GHSA-p33q-w45h-2hcj: Malicious Package in 4equest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 4equest package is an npm package that has been affected by a vulnerability. It is a typosquatting package, meaning it intentionally mimics the name of a popular package to deceive users. The package tracked users who installed it incorrectly and uploaded information to a remote server. This information included the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo. The package does not compromise further than this.
Vulnerability Detail
The vulnerability in the 4equest package arises from its typosquatting nature. By tricking users into installing the incorrect package, it collects sensitive information and sends it to a remote server. This can lead to privacy breaches and potential misuse of the gathered data. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The 4equest package has been found to be a typosquatting package that collects sensitive information from users who install it incorrectly. To mitigate this vulnerability, it is crucial to remove the package from dependencies and ensure correct package name typing during installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for 4equest →
FAQ
Typosquatting is a technique where malicious actors create packages with names similar to popular packages, aiming to deceive users who mistype the intended package name.
The 4equest package collected the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo.
The potential ramifications of this vulnerability include privacy breaches, misuse of collected data, and potential exploitation of the compromised system.
To ensure you're installing the correct package, double-check the package name before installation, verify the package's source and reputation, and consider using package managers with built-in security features.
No, there is no further compromise reported beyond the data collection performed by the 4equest package.
References
Related vulnerabilities
Recent vulnerabilities recorded for 4equest.
