Malicious Package in requst
Summary
GHSA-8qx4-r7fx-xc4v: Malicious Package in requst. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requst package is an npm package used for making HTTP requests in Node.js applications. It is vulnerable to a malicious package attack where a typosquatted package with a similar name was uploaded to the npm registry. This malicious package tracked users who installed it and sent information to a remote server. The package collected details such as the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges.
Vulnerability Detail
The vulnerability in the requst package allowed for the distribution of a malicious package that could track users and collect sensitive information. The attack relied on users mistyping the package name during installation. Once installed, the malicious package sent the collected information to a remote server. The impact of this vulnerability could include the compromise of user privacy, potential exposure of sensitive data, and the possibility of further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, following the recommended steps to fix the vulnerability should mitigate the risk.
Conclusion
The requst package was found to have a critical vulnerability where a malicious package with a similar name was distributed. This package tracked users and collected sensitive information. To fix this vulnerability, remove the package from your dependencies and ensure correct package names during installation. Regularly updating packages is also recommended. For further support, contact DevNack.com.
See every vulnerability recorded for requst →
FAQ
The impact of this vulnerability could include the compromise of user privacy, potential exposure of sensitive data, and the possibility of further attacks.
To fix this vulnerability, remove the requst package from your dependencies and ensure correct package names during installation. Regularly update your packages to stay secure.
There is no specific workaround mentioned for this vulnerability. Following the recommended steps to fix the vulnerability should mitigate the risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for requst.
