GHSA-8qx4-r7fx-xc4v

Suggest an improvement
Source
https://github.com/advisories/GHSA-8qx4-r7fx-xc4v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8qx4-r7fx-xc4v/GHSA-8qx4-r7fx-xc4v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8qx4-r7fx-xc4v
Published
2020-09-11T21:08:19Z
Modified
2021-10-01T14:08:31Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Malicious Package in requst
Details

All versions of requst typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.

Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Database specific 
{
    "cwe_ids":  [
        "CWE-506"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:38:41Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}
References

Affected packages

npm / requst

Package

Name
requst
View open source insights on deps.dev
Purl
pkg:npm/requst

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8qx4-r7fx-xc4v/GHSA-8qx4-r7fx-xc4v.json"