Executive brief
The erquest package is a typosquatting attack that impersonates a legitimate npm package of similar name. If developers accidentally install erquest instead of the intended package, the malicious code collects and sends sensitive information to remote servers, including the package name, developer environment details, and whether it's running with elevated privileges. This could aid attackers in targeting specific development environments or systems for further attacks.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code) that exploits typosquatting to trick developers into installing the wrong dependency. The package name erquest closely resembles legitimate packages, leading to accidental installation. Upon execution, the malicious package exfiltrates system information to a remote server, including the downloaded package name, intended package name, Node.js version, and whether the process runs as sudo. No further compromise or payload delivery occurs beyond reconnaissance. The attack vector is indirect—it requires a developer to misspell the intended package name during installation. Remediation is to remove the package from dependencies and verify correct package names during installation.
Affected products
- npm erquest all versions
Timeline
- 2020-09-02: disclosed