The curlrequest npm package through 1.0.1 is affected by CVE-2020-7646 / GHSA-m8xj-5v73-3hh8. GitHub Advisory and OSV describe command-injection risk, while current NVD, CVE.org, and Snyk metadata describe arbitrary file-read risk for the same package advisory. Public sources list no patched npm release, and npm registry metadata shows 1.0.1 as the latest published version [S1][S2][S3][S4][S5][S6].
Impact
If an application, worker, automation job, or API route calls curlrequest with attacker-controlled URL, header, proxy, file, or option data, affected versions may let that input cross into unsafe curl wrapper behavior [S1][S5]. Depending on the reachable call site and deployment environment, the practical impact can include unintended command execution or local file access. A dependency match alone does not prove that the package is installed in production, invoked at runtime, or reachable from untrusted input.
Root Cause
curlrequest is a Node.js wrapper around curl. The public advisories describe unsafe handling around user-influenced request options and file input in affected releases [S1][S2][S5]. The issue is classified under CWE-78 for command-injection style command-boundary risk, with current source metadata also preserving the arbitrary-file-read wording [S1][S3][S4].
How FixVibe covers it
FixVibe's GitHub repo scans flag npm manifests and lockfiles that resolve or allow curlrequest in the affected range, showing the package, version and file so you can remove or replace it.
Fixes
Public advisories do not list a patched curlrequest release. Remove curlrequest or replace it with a maintained HTTP client such as the built-in fetch API, undici, axios, or got that does not shell out through a curl wrapper [S5][S6]. Regenerate the active npm, pnpm, or Yarn lockfile, rebuild every runtime image, worker, devcontainer, CI cache, and package-manager cache that installs dependencies, and rerun the FixVibe GitHub repo scan. Review call sites so untrusted request, webhook, job, URL, header, proxy, file-path, curl option, or request option data cannot reach shell-backed HTTP helpers.