Executive brief
The "reques" npm package is a malicious typosquat of the legitimate "request" package. When installed, it collects and sends user environment information (Node version, sudo status, package names) to a remote server. Organizations using this package should immediately remove it from their dependencies and verify the correct package name spelling in their package manifests.
Technical details
This is a supply-chain attack exploiting typosquatting: the package name "reques" closely resembles the popular "request" HTTP client library. Upon installation, all versions of the malicious package exfiltrate metadata to a remote server, including the downloaded package name, the intended package name, the Node.js version, and whether the process ran with sudo privileges. The attack requires no authentication or user interaction beyond the initial (mis)installation. No additional code compromise occurs once this telemetry is reported. Mitigation requires removing the package and auditing dependency lock files to ensure correct package names are specified.
Affected products
- npm reques all versions
Timeline
- 2020-09-02: disclosed