Executive brief
A malicious npm package named "requeest" was designed to trick developers into installing it by mimicking the name of a legitimate package. Once installed, the package secretly collected and transmitted information about the developer's environment, including their Node.js version and whether they were running as an administrator. This represents a supply chain attack that compromises the integrity of development environments.
Technical details
This malicious npm package exploits typosquatting—deliberately using a name similar to a legitimate package—to trick developers into installing it. The package contained code to exfiltrate metadata about the installed environment, including the package name, intended package name, Node.js version, and sudo privilege status, sending this data to a remote server. No further code execution or system compromise occurs beyond the data collection itself. The attack vector is supply chain compromise through manual package installation; it requires no authentication or special privileges beyond npm access. Users must manually remove the package from their dependencies and verify correct package names during installation.
Affected products
- npm requeest all versions
Timeline
- 2020-09-02: disclosed