Malicious Package in requeest - Critical Vulnerability
Summary
GHSA-8vj3-jgcf-77jv: Malicious Package in requeest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requeest package is an npm package that has been affected by a critical vulnerability. It is a typosquatting attack where a malicious package with a similar name was uploaded to the npm registry. This package tracked users who installed it and sent information to a remote server. The package collected data such as the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges. The package did not compromise the system further.
Vulnerability Detail
The vulnerability in the requeest package allowed for the installation of a malicious package that tracked user information. This could lead to privacy breaches and potential misuse of the collected data. The package uploaded the collected information to a remote server, which could be used for malicious purposes. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requeest package has been affected by a critical vulnerability that allowed for the installation of a malicious package. This package tracked user information and uploaded it to a remote server. To mitigate the risk, it is crucial to remove the affected package, ensure correct package names during installation, and stay updated on security advisories. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for requeest →
FAQ
The impact of this vulnerability is the potential compromise of user privacy and the collection of sensitive information by a malicious package.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file to analyze and receive real-time alerts for open-source vulnerabilities.
If your application is affected by this vulnerability, it is recommended to remove the requeest package from your dependencies and follow the steps mentioned in the 'how_to_fix' section to mitigate the risk.
There is no specific workaround mentioned for this vulnerability. The best approach is to remove the affected package and follow the recommended steps to fix the vulnerability.
To stay informed about vulnerabilities in your packages, regularly update your packages and keep an eye on security advisories. Services like Vulert can also help monitor and alert you in real-time for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for requeest.
