Malicious Package in equest - Remote Code Execution
Summary
GHSA-mvch-rh6h-2m47: Malicious Package in equest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The equest package is an npm package used for making HTTP requests in Node.js applications. It provides a simple and convenient API for sending HTTP requests and handling responses. Unfortunately, all versions of equest were found to contain a malicious package that was typosquatted, tricking users into installing the incorrect package. This malicious package tracked users who had installed it and uploaded information to a remote server. The uploaded data included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges. The package did not compromise the system further, but it posed a significant security risk to affected users.
Vulnerability Detail
The vulnerability in the equest package allowed for remote code execution due to the installation of a malicious package. By typosquatting a popular package, the attacker tricked users into installing the incorrect package, which then tracked and uploaded sensitive information to a remote server. This information could potentially be used for further attacks or unauthorized access. The vulnerability had a critical severity level with a CVSS score of 9.8, indicating a high risk to affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The equest package was found to contain a malicious package that tracked and uploaded sensitive information to a remote server. This vulnerability allowed for remote code execution and posed a significant risk to affected systems. To mitigate this vulnerability, it is recommended to remove the equest package from your dependencies and always ensure correct package names are used during installation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for equest →
FAQ
The impact of this vulnerability is that an attacker could execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
Yes, all versions of equest were found to contain the malicious package. It is recommended to remove the package from your dependencies regardless of the version.
The malicious package tracked the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running with sudo privileges. This information was uploaded to a remote server.
No, there is no evidence of further compromise beyond the information upload. However, it is crucial to remove the malicious package and ensure the correct package is installed to mitigate any potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for equest.
