Malicious Package in requesst
Summary
GHSA-6c37-2rw5-9j7x: Malicious Package in requesst. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requesst package is an npm package that has been typosquatted to mimic a popular package with a similar name. It is used for making HTTP requests in Node.js applications. The package has been compromised and includes malicious code that tracks users who have installed the incorrect package. The compromised package collects information such as the name of the downloaded package, the intended package name, the Node version, and whether the process is running with sudo privileges. The package does not cause any further compromise beyond collecting this information.
Vulnerability Detail
The vulnerability in the requesst package arises from its typosquatting nature and the inclusion of malicious code. When users mistakenly install this package instead of the intended package, their information is collected and sent to a remote server. This can lead to privacy breaches and potential misuse of the collected data. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requesst package has been compromised through typosquatting, leading to the collection of user information. To mitigate this vulnerability, it is crucial to remove the package from dependencies and exercise caution when installing packages with similar names. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for requesst →
FAQ
The requesst package is used for making HTTP requests in Node.js applications.
The requesst package includes malicious code that tracks users who have installed it instead of the intended package. It collects information such as the name of the downloaded package, the intended package name, the Node version, and whether the process is running with sudo privileges. This information is then sent to a remote server.
The potential ramifications of this vulnerability include privacy breaches and potential misuse of the collected user information.
To fix this vulnerability, remove the requesst package from your dependencies and ensure that package names are typed correctly during installation.
No, there is no specific workaround available for this vulnerability. The recommended approach is to remove the requesst package and ensure correct package names during installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for requesst.
