Executive brief
The "requset" package is a malicious npm library that intentionally mimics the name of a popular package to trick developers into installing it by mistake. Once installed, the package silently collects and sends information about the user's environment (Node version, sudo status, package names) to a remote server, enabling attackers to track installations and build a database of compromised development systems.
Technical details
This is a supply-chain attack via typosquatting: the malicious "requset" package intentionally uses a name similar to a legitimate popular package to deceive developers into mistyping the package name during installation. The package contains embedded malicious code (CWE-506) that exfiltrates reconnaissance data to an attacker-controlled server, including the downloaded package name, intended package name, Node version, and whether the process runs with sudo privileges. No further system compromise or code execution occurs beyond data exfiltration. The attack vector is social engineering / installation mistake; the fix is manual removal of the package from dependencies and verification of correct package names.
Affected products
- npm requset all versions
Timeline
- 2020-09-02: published