Malicious Package in requets
Summary
GHSA-f3pc-c2gf-hvgw: Malicious Package in requets. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requets package is an npm package used for making HTTP requests in Node.js applications. It provides a simple and convenient interface for sending HTTP requests and handling responses. However, all versions of requets were found to have a vulnerability where a malicious package with a similar name was typosquatted. This malicious package tracked users who installed it and uploaded information to a remote server. The package collected data such as the name of the downloaded package, the intended package name, the Node version, and whether the process was running as sudo. It is important to note that there is no further compromise beyond the data collection.
Vulnerability Detail
The vulnerability in the requets package allowed for typosquatting, where a malicious package with a similar name was uploaded to the npm registry. When users mistakenly installed this malicious package, it tracked their activity and sent collected information to a remote server. The collected data included details about the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges. This vulnerability poses a risk to the privacy and security of users who inadvertently installed the malicious package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requets package was found to have a vulnerability where a malicious package with a similar name was typosquatted. This package tracked users who installed it and collected information such as the package name, Node version, and sudo privileges. To mitigate this vulnerability, it is recommended to remove the requets package from your dependencies and exercise caution when installing packages. Always verify the package name and ensure its authenticity. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for requets →
FAQ
Installing the malicious package could result in the compromise of sensitive information, such as the package name, Node version, and sudo privileges. This information could be used for malicious purposes or further attacks.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert uses package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
The best mitigation is to remove the requets package from your dependencies and ensure that you install the correct package with the intended name. Always double-check package names and verify their authenticity before installation.
There are no known exploits beyond the data collection performed by the malicious package. However, it is crucial to address this vulnerability promptly to prevent any potential misuse of the collected information.
The fix for this vulnerability involves removing the requets package from your dependencies and being cautious when installing packages. Always verify the package name and ensure its authenticity before proceeding with the installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for requets.
