Executive brief
The rqeuest npm package is a typosquatting attack targeting developers who misspell the popular "request" library. The malicious package collects and transmits information about installed packages, Node.js version, and sudo status to a remote server. This represents a supply chain compromise that can compromise development environments and potentially leak sensitive operational details.
Technical details
This is a malicious package (CWE-506: Embedded Malicious Code) distributed via npm as a typosquatting variant of the legitimate "request" package. All versions of rqeuest contain embedded code that collects and exfiltrates metadata including the package name installed, the intended package name, Node.js version, and whether the process runs with elevated privileges. The attack occurs at installation time, affecting any developer environment where the package is added to dependencies. No additional runtime exploitation is required; the malicious behavior is triggered during package installation. Users must remove the package and verify correct package names.
Affected products
- npm rqeuest all versions
Timeline
- 2020-09-02: disclosed