Malicious Package in rrequest - Critical Vulnerability
Summary
GHSA-wc7q-qpm4-8pqv: Malicious Package in rrequest. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rrequest package is an npm package used for making HTTP requests in Node.js applications. It provides a convenient interface for sending HTTP requests and handling responses. However, all versions of rrequest were found to contain a critical vulnerability. The package was typosquatted, meaning a malicious package with a similar name was uploaded to the npm registry. This malicious package tracked users who installed it and sent information to a remote server. The information collected included the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges.
Vulnerability Detail
The typosquatted package in rrequest posed a significant security risk to users. By installing the malicious package, users unknowingly exposed their system information to the attacker. This information could be used for further attacks or sold to other malicious actors. The vulnerability did not result in immediate compromise beyond the data collection, but it highlighted the importance of verifying package names and ensuring their authenticity before installation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The rrequest package was found to contain a critical vulnerability due to a typosquatted package. This vulnerability allowed the attacker to track users who installed the malicious package and collect system information. To mitigate this risk, it is recommended to remove the rrequest package from dependencies and ensure the correct package name is used during installation. Always verify the authenticity of packages before installation to prevent typosquatting attacks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for rrequest →
FAQ
rrequest is an npm package used for making HTTP requests in Node.js applications. It provides a convenient interface for sending HTTP requests and handling responses.
The typosquatted package in rrequest included code that sent information to a remote server. This code tracked the name of the downloaded package, the intended package name, the Node version, and whether the process was running with sudo privileges.
By installing the malicious package, users exposed their system information to the attacker. This information could be used for further attacks or sold to other malicious actors.
No, there was no immediate compromise beyond the data collection. However, it is crucial to remove the malicious package and take precautions to prevent similar attacks in the future.
To ensure package authenticity, always double-check the package name before installation. Verify the package's source, check for reviews and ratings, and consider using trusted package managers or registries.
References
Related vulnerabilities
Recent vulnerabilities recorded for rrequest.
