Executive brief
A malicious npm package named "requuest" was designed to trick developers into installing it instead of the legitimate "request" package. Once installed, it secretly collected and transmitted information about the developer's system (package name, Node version, sudo status) to a remote server. This represents a supply-chain attack that compromises development environments and potentially organizational infrastructure.
Technical details
This is a typosquatting attack exploiting package naming confusion in the npm ecosystem. The malicious "requuest" package implemented tracking code that exfiltrated metadata about the installation environment including the package name, intended package name, Node version, and process privilege level to a remote server. The attack vector is social engineering / user error (typing the wrong package name), with no authentication or network-specific preconditions beyond npm registry access. The vulnerability affects all versions of the requuest package. Remediation is removal of the package from dependencies and verification of correct package names during installation.
Affected products
- npm requuest all versions
Timeline
- 2020-09-02: disclosed