Malicious Package in reuest - Open Source Vulnerability
Summary
GHSA-r863-p739-275c: Malicious Package in reuest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The reuest package is an npm package that is used for making HTTP requests in Node.js applications. It provides a simple and convenient way to send HTTP requests and handle responses. The package is widely used in various projects and has a large user base. However, all versions of the reuest package were found to contain a malicious package that was typosquatted a popular package of similar name. This malicious package tracked users who had installed the incorrect package and uploaded information to a remote server. The compromised information included the name of the downloaded package, name of the intended package, the Node version, and whether the process was running as sudo. It is important to remove the package from dependencies and ensure correct package names are used during installation.
Vulnerability Detail
The vulnerability in the reuest package arises from the inclusion of a malicious package that masquerades as a legitimate package. This typosquatting technique tricks users into installing the incorrect package, which then tracks and uploads sensitive information to a remote server. The compromised information can potentially be used for malicious purposes. The vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8, indicating its high impact and the need for immediate action.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The reuest package contains a critical vulnerability due to the inclusion of a malicious package that tracks and uploads sensitive information. To mitigate this vulnerability, it is crucial to remove the package from dependencies and ensure correct package names are used during installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reuest →
FAQ
The reuest package is used for making HTTP requests in Node.js applications. It provides a convenient way to send HTTP requests and handle responses.
The typosquatting attack involves creating a malicious package with a similar name to a popular package. Users who mistakenly install the incorrect package are then tracked, and their sensitive information is uploaded to a remote server.
The malicious package tracks and uploads information including the name of the downloaded package, name of the intended package, the Node version, and whether the process was running as sudo.
The vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8, indicating its high impact and the need for immediate action.
To ensure you are installing the correct packages, always double-check the package names before installation. Avoid relying solely on auto-completion or copy-pasting package names.
References
Related vulnerabilities
Recent vulnerabilities recorded for reuest.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
