Malicious Package in requestt
Summary
GHSA-2563-83p7-f34p: Malicious Package in requestt. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is requestt, an npm package used for making HTTP requests in Node.js applications. It is vulnerable to a typosquatting attack where a malicious package with a similar name was uploaded to the npm registry. This malicious package tracked users who installed it and sent information to a remote server. The package collected details such as the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges. It is important to note that there is no further compromise beyond the data collection.
Vulnerability Detail
The vulnerability in requestt arises from the typosquatting attack, where users mistakenly install the malicious package instead of the intended one. This allows the attacker to gather information about the affected system, potentially leading to further targeted attacks. The collected data includes package names, Node version, and sudo privilege status. The impact of this vulnerability can vary depending on the sensitivity of the information collected and the actions the attacker may take based on it.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requestt package was found to be vulnerable to a typosquatting attack where a malicious package with a similar name was uploaded to the npm registry. This package collected information about the affected system and sent it to a remote server. To remediate this vulnerability, it is recommended to remove the requestt package from your dependencies and ensure correct package names during installation. Regularly reviewing and validating the packages used in your application can help mitigate the risk of such vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for requestt →
FAQ
requestt is an npm package used for making HTTP requests in Node.js applications. It provides a convenient interface for handling various HTTP methods and managing request/response data.
In a typosquatting attack, the attacker uploads a malicious package with a name similar to a popular package. Users who mistakenly install the malicious package instead of the intended one become vulnerable to the attacker's actions.
The malicious package collects the name of the downloaded package, the intended package name, the Node version, and whether the process is running with sudo privileges. This information is sent to a remote server controlled by the attacker.
The collected information can be used by the attacker for further targeted attacks. Depending on the sensitivity of the data collected, the attacker may exploit vulnerabilities specific to the installed package or launch social engineering attacks based on the gathered information.
To mitigate the risk of typosquatting attacks, always double-check the package name before installation. Pay attention to any warnings or recommendations provided by package managers. Regularly review and validate the packages used in your application to ensure they come from trusted sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for requestt.
