Executive brief
4equest is a malicious npm package that impersonates a legitimate library of similar name (typosquatting). When installed, it silently collects information about the installation, including the package name, intended target, Node.js version, and privilege level, and transmits this data to a remote server. This represents a supply chain attack that could be used for reconnaissance or further compromise of development environments.
Technical details
This vulnerability is a typosquatting attack (CWE-506) in which a malicious npm package intentionally mimics the name of a popular legitimate package to trick developers into installing it. Upon installation, the package exfiltrates metadata to a remote server, including the package name typed at installation, the name of the intended target package, Node.js version, and whether the process ran with sudo privileges. The attack requires only that a developer mistype the package name during installation; no authentication or special preconditions are needed. The data collection occurs automatically without user awareness. The only mitigation is to remove the package from dependencies, and the advisory recommends always double-checking package names before installation.
Affected products
- npm 4equest all versions
Timeline
- 2020-09-02: disclosed