Executive brief
The npm package "reqquest" was a malicious typosquat of the legitimate "request" library, designed to deceive developers into installing the wrong package. Once installed, the malicious package tracked and reported telemetry data about the installation to remote servers, including package names, Node version, and sudo status. This represents a supply-chain attack vector that could enable attackers to map development environments and infrastructure.
Technical details
This is a malicious package vulnerability (CWE-506: Embedded Malicious Code) delivered via typosquatting—registering a package with a name visually similar to a popular legitimate package ("request" vs "reqquest"). The attack vector is network-based, triggered at installation time with no authentication or user interaction required beyond the npm install command. The malicious payload executes automatically during package installation and establishes outbound communication to exfiltrate metadata about the target environment (package name, Node version, process privileges). The vulnerability affects all versions of reqquest and cannot be patched; the only mitigation is removal of the package from dependencies and verification of correct package names during installation.
Affected products
- npm reqquest all versions
Timeline
- 2020-09-02: disclosed: Malicious typosquatting package discovered and published in security advisory
- 2020-08-31: other: GitHub security review completed