Malicious Package in requuest - Critical Vulnerability
Summary
GHSA-frxq-v7fm-m4pv: Malicious Package in requuest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The requuest package is an npm package used for making HTTP requests in Node.js applications. It provides a simple and convenient way to send HTTP requests and handle responses. However, all versions of requuest were found to be typosquatting a popular package of a similar name. This malicious package tracked users who had installed the incorrect package and uploaded information to a remote server. The uploaded data included the name of the downloaded package, the name of the intended package, the Node version, and whether the process was running as sudo. It is important to note that there is no further compromise beyond the data collection.
Vulnerability Detail
The vulnerability in the requuest package arises from its typosquatting behavior and the subsequent tracking of users. By installing the malicious package, users unknowingly expose their system information to a remote server. This can lead to potential privacy concerns and the misuse of collected data. The severity of this vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The requuest package has been found to contain a critical vulnerability due to its typosquatting behavior and user tracking. To protect your system and data, it is crucial to remove the package from your dependencies and ensure the correct installation of packages. Regularly updating and reviewing your dependencies can help mitigate the risk of such vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for requuest →
FAQ
The requuest package is an npm package used for making HTTP requests in Node.js applications. It simplifies the process of sending HTTP requests and handling responses.
The malicious package tracks users by collecting information such as the name of the downloaded package, the name of the intended package, the Node version, and whether the process is running as sudo. This information is then uploaded to a remote server.
The potential ramifications of this vulnerability include privacy concerns and the misuse of collected data. The collected information can be used for malicious purposes or sold to third parties without the user's consent.
To mitigate the risk of this vulnerability, it is recommended to remove the requuest package from your dependencies and ensure that package names are typed correctly during installation. Regularly reviewing and updating your dependencies can also help mitigate the risk of such vulnerabilities.
No, there is no further compromise beyond the data collection. The malicious package only tracks users and uploads the collected information to a remote server.
References
Related vulnerabilities
Recent vulnerabilities recorded for requuest.
