Executive brief
The reequest npm package is a malicious typosquatting attack targeting developers who mistype the name of a legitimate, popular package. When installed, it silently tracks and reports user information—including developer identity, Node.js version, and whether the process runs with elevated privileges—to a remote server. This represents a supply chain compromise that could enable targeted attacks against affected organizations.
Technical details
The vulnerability is classified as malicious code injection (CWE-506). The reequest package intentionally mimics the name of a legitimate npm package to deceive developers into installing it; this is a typosquatting attack. Once installed, the package collects system metadata (package name, intended target, Node version, sudo status) and exfiltrates it to an attacker-controlled server without user consent. The attack vector is social engineering / supply chain, as the attacker relies on users mistyping the legitimate package name during installation. No additional authentication or preconditions are required beyond installation. The sole mitigation is immediate removal of the malicious package from all dependencies; no patch exists.
Affected products
- npm reequest all versions
Timeline
- 2020-09-02: disclosed