npm package report

Is reqquest safe?

This package is in our known-malicious corpus. Details below.

Flagged as malicious

malware, affects all versions

cvss

not scored

how bad it is if exploited, out of 10

epss

not scored

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-4jfq-q299-g4cr, the advisory selected below

// advisories

GHSA-4jfq-q299-g4cr

UNKNOWN

All versions of reqquest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.

Affected: >=0
Fixed in: not stated
Weakness: CWE-506
Published: 2020-09-02
Source: osv

OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:41 UTC. The most recent advisory here was published 2020-09-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is reqquest safe? npm package security report | CyberXYZ