PT-2020-21260

Published

2020-09-02

·

Updated

2020-09-02

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions requets (affected versions not specified)
Description The requets package is a typosquatted version of a popular package with a similar name. It tracks users who have installed the incorrect package and uploads information to a remote server, including the name of the downloaded package, the name of the intended package, the Node version, and whether the process is running as sudo. There is no further compromise.
Recommendations Remove the requets package from your dependencies. Always ensure package names are typed correctly upon installation.
Exploitability
Fix
Impacts
Vendors
Affected products
Related identifiers
GHSA-F3PC-C2GF-HVGW
Found an issue in the description? Have something to add? Feel free to write us 👾