Malicious Package in reqest
Summary
GHSA-hg5q-rj62-c43g: Malicious Package in reqest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The reqest package is an npm package that has been affected by a vulnerability. It is a typosquatting attack where a malicious package with a similar name was uploaded to the npm registry. This package tracked users who installed it and collected information such as the name of the downloaded package, the intended package, the Node version, and whether the process was running as sudo. The package did not compromise further than collecting this information.
Vulnerability Detail
The vulnerability in the reqest package allowed for the installation of a malicious package that tracked user information. This could potentially lead to privacy breaches and the collection of sensitive data. The package uploaded the collected information to a remote server. It is important to note that the package did not perform any further compromise beyond collecting the specified information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The reqest package has been affected by a typosquatting attack where a malicious package with a similar name was uploaded to the npm registry. This package tracked user information but did not perform any further compromise. To fix this vulnerability, remove the reqest package from your dependencies and ensure package names are typed correctly during installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for reqest →
FAQ
The impact of this vulnerability is the potential compromise of user privacy and the collection of sensitive information.
To protect your application, remove the reqest package from your dependencies and ensure that package names are typed correctly during installation.
Yes, the fix for this vulnerability is to remove the reqest package from your dependencies and be cautious when installing packages to avoid typosquatting attacks.
There are no known exploits beyond the collection of user information by the malicious package.
Once the reqest package is removed, it is recommended to review your application for any potential privacy breaches and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for reqest.
