Malicious Package in erquest - Remote Code Execution
Summary
GHSA-4pmg-jgm5-3jg6: Malicious Package in erquest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
erquest is an npm package that provides functionality for making HTTP requests in Node.js applications. It is vulnerable to a malicious package attack where a typosquatted package of similar name was uploaded to the npm registry. This malicious package tracked users who installed it and sent information to a remote server, including the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo. The package does not compromise the system further.
Vulnerability Detail
The vulnerability in erquest arises from the typosquatted package that was uploaded to the npm registry. When users mistakenly installed this package, it collected and transmitted sensitive information to a remote server. This information could potentially be used for malicious purposes. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8. The CWE ID associated with this vulnerability is CWE-506.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The erquest package was found to be vulnerable to a typosquatting attack where a malicious package was uploaded to the npm registry. This package collected and transmitted sensitive information to a remote server. To mitigate this vulnerability, it is recommended to remove the erquest package from dependencies and ensure correct package names during installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for erquest →
FAQ
erquest is an npm package that provides functionality for making HTTP requests in Node.js applications.
A typosquatted package is a malicious package that is uploaded to a package registry with a name similar to a popular package. It aims to trick users into installing it by making typographical errors in the package name.
The malicious package collected the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo. This information was sent to a remote server.
The collected information could be used for malicious purposes, such as identifying vulnerable systems or launching targeted attacks. However, there is no evidence of further compromise beyond the data collection.
To prevent installing malicious packages, always double-check the package name before installation. Pay attention to any typographical errors and verify the package's authenticity.
References
Related vulnerabilities
Recent vulnerabilities recorded for erquest.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
