Executive brief
A malicious npm package named "reuest" was published as a typosquat of a legitimate package, intentionally deceiving developers into installing it. Upon installation, the package tracked and reported user information (package names, Node version, sudo status) to remote servers, providing attackers with reconnaissance data about affected development environments and supply chains.
Technical details
This is a supply-chain attack via package typosquatting and malicious package code injection. The "reuest" package was designed to deceive developers who misspelled the name of a legitimate package, and executed tracking code that harvested environment metadata (intended package name, downloaded package name, Node version, and privilege level) and exfiltrated it to an attacker-controlled server. The attack required only that a developer make a typo during package installation; no authentication bypass or additional preconditions were needed. The attack surface is npm's public registry and human error in package name entry. All versions of the reuest package contained the malicious payload. Remediation requires identifying and removing the package from all dependencies.
Affected products
- npm reuest all versions
Timeline
- 2020-09-11: disclosed