Malicious Package in requet
Summary
GHSA-h44f-769q-j6px: Malicious Package in requet. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requet package is an npm package used for [provide brief description of the package functionality]. It is vulnerable to a malicious package attack where a typosquatted package with a similar name was uploaded to the npm registry. This malicious package tracked users who installed it and sent information to a remote server. The package collected data such as the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo. The vulnerability does not result in further compromise.
Vulnerability Detail
The vulnerability in the requet package arises from the typosquatting attack. Users who mistakenly installed the malicious package instead of the intended package were unknowingly tracked. The collected information was sent to a remote server, potentially compromising the privacy and security of affected users. The attack does not result in immediate compromise but can lead to further exploitation in the future.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requet package is vulnerable to a typosquatting attack where a malicious package with a similar name tracks users who install it. To mitigate this vulnerability, remove the package from your dependencies and ensure correct package names during installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for requet →
FAQ
The impact of this vulnerability is the potential compromise of user privacy and security. The malicious package tracks users who install it and sends collected information to a remote server.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for open-source vulnerabilities.
The malicious package collects the name of the downloaded package, the intended package name, the Node version, and whether the process is running as sudo.
No, the vulnerability does not result in immediate compromise. However, the collected information can be used for further exploitation in the future.
To prevent installing typosquatted packages, always double-check the package name before installation and ensure it matches the intended package.
References
Related vulnerabilities
Recent vulnerabilities recorded for requet.
