Executive brief
A malicious npm package named "requets" was distributed as a typosquatted variant of the legitimate "requests" library. The package tracked users who installed it by collecting and uploading system information (package name, intended target, Node.js version, and sudo privileges) to a remote server. This is a supply-chain attack exploiting common typing mistakes during package installation.
Technical details
This is a malicious package distribution vulnerability (CWE-506: Embedded Malicious Code). The "requets" package was intentionally created to mimic the popular "requests" library, relying on typosquatting to trick developers into installing it. Upon installation, the package exfiltrates metadata about the installation environment to a remote server, including the package name, intended package name, Node.js version, and whether the process ran with elevated (sudo) privileges. The attack requires only that a developer mistype the package name during installation—no authentication or special preconditions are needed. The package was available on npm across all versions.
Affected products
- npm requets all versions
Timeline
- 2020-09-02: disclosed