Executive brief
The requesst npm package is a malicious typosquatting variant of the legitimate "request" library that was designed to deceive developers into installing the wrong package. Once installed, it silently exfiltrates information about the user's system (Node version, sudo status) and installation environment to remote servers. This type of attack compromises supply chain security and can be a foothold for deploying additional malware.
Technical details
The vulnerability is a malicious package (CWE-506) that typosquats the popular "request" npm library using a nearly identical name. The malicious package harvests and exfiltrates telemetry data including the downloaded package name, intended package name, Node.js version, and whether the process runs with sudo privileges to a remote server. Attack vector is network-based; the vulnerability requires the developer to mistype the package name during installation (a supply chain compromise vector). All versions of requesst are affected. The package has been removed from npm; mitigation is to purge it from dependencies and verify correct package names during installation.
Affected products
- npm requesst
Timeline
- 2020-09-02: disclosed