Executive brief
A malicious software package named 'requestt' was discovered on the npm registry, designed to trick developers who mistyped the name of a popular legitimate library. When installed, the package automatically collects and sends information about the user's system to a remote server, including their Node.js version and whether they are running with administrative privileges. This poses a privacy risk and indicates a breach of trust in the software supply chain.
Technical details
The 'requestt' package is a malicious typosquatting attempt targeting the popular 'request' library. It contains a post-install or execution script that exfiltrates environment metadata to a remote server, including the package name, the intended package name, the Node.js version, and the sudo status of the process. This behavior is classified under CWE-506 (Embedded Malicious Code). The attack vector is remote and requires no authentication, relying on user error during package installation. Users are advised to audit their dependencies and remove this package immediately.
Affected products
- npm requestt All versions
Timeline
- 2020-08-31: advisory: GitHub reviewed the advisory
- 2020-09-02: disclosed: Advisory published