Executive brief
The requet npm package is a typosquatting attack that masquerades as a legitimate, popular package. When installed, it collects and transmits information about the user's environment (package names, Node version, sudo status) to a remote server. This represents a supply-chain compromise that puts developers at risk of surveillance and potential follow-up attacks.
Technical details
This is a malicious package vulnerability (CWE-506: embedded malicious code). The requet package was intentionally designed to typosquat a legitimate npm package and siphon user information upon installation. The attack vector is network-based and requires no authentication or user interaction beyond the initial install command. All versions of the package contained the malicious code; there is no legitimate version. The payload exfiltrates environment metadata (package name, intended package name, Node version, and sudo status) to an attacker-controlled server. No further code execution or system compromise occurs beyond telemetry collection.
Affected products
- npm requet all versions
Timeline
- 2020-09-02: disclosed: Published in GitHub Advisory Database