Executive brief
equest is a Node.js package that was published as a typosquatting attack against a legitimate package. The malicious version collected and transmitted user information—including package name, intended target package, Node version, and sudo privileges—to a remote server. Any developer who installed the package due to a typo would have unknowingly transmitted system telemetry to an attacker-controlled server.
Technical details
equest is a typosquatting attack delivering a malicious npm package. Upon installation, the package collects and exfiltrates sensitive telemetry data—including the package name, target package name, Node.js version, and whether the installation process was running with sudo privileges—to an attacker-controlled remote server. The attack vector is network-based with no authentication or user interaction required beyond the initial (misdirected) installation. No further compromise or code execution beyond telemetry collection has been documented. The vulnerability exploits supply-chain trust and developer typos; the only mitigation is package removal and verification of correct package names during installation.
Affected products
- npm equest all versions
Timeline
- 2020-09-11: disclosed: Advisory published on GitHub and npm
- 2020-08-31: other: GitHub reviewed the advisory