diff --git a/lib/protect/fetch-patch.js b/lib/protect/fetch-patch.js
index 5ce94d162e..2cbc25f3f3 100644
--- a/lib/protect/fetch-patch.js
+++ b/lib/protect/fetch-patch.js
@@ -1,13 +1,13 @@
 module.exports = getPatchFile;
 
 var Promise = require('es6-promise').Promise; // jshint ignore:line
-var request = require('request');
+var needle = require('needle');
 var fs = require('then-fs');
 var analytics = require('../analytics');
 
 function getPatchFile(url, filename, attempts) {
   return new Promise(function (resolve, reject) {
-    request(url)
+    needle.get(url)
       .on('response', function (response) {
         if (response.statusCode >= 400) {
           if (!attempts) {
@@ -21,7 +21,7 @@ function getPatchFile(url, filename, attempts) {
           return resolve(getPatchFile(url, filename, attempts - 1));
         }
       })
-      .on('end', function () {
+      .on('done', function () {
         resolve(filename);
       })
       .on('error', function (err) {
diff --git a/lib/request/request.js b/lib/request/request.js
index 9c06d7fbdd..14c83c16c9 100644
--- a/lib/request/request.js
+++ b/lib/request/request.js
@@ -1,11 +1,14 @@
+/* jscs:disable requireCamelCaseOrUpperCaseIdentifiers */
+/* jshint camelcase: false */
 module.exports = makeRequest;
 
 var debug = require('debug')('snyk:req');
 var Promise = require('es6-promise').Promise; // jshint ignore:line
-var request = require('request');
+var needle = require('needle');
 var stream = require('stream');
 var parse = require('url').parse;
 var format = require('url').format;
+var querystring = require('querystring');
 var zlib = require('zlib');
 var config = require('../config');
 
@@ -22,6 +25,7 @@ function makeRequest(payload) {
       var json = JSON.stringify(body);
       bodyStream.push(json);
       bodyStream.push(null);
+      bodyStream = bodyStream.pipe(zlib.createGzip());
 
       debug('compressing body (%s)', json.length);
       if (json.length < 1e4) {
@@ -49,18 +53,29 @@ function makeRequest(payload) {
     }
 
     debug('request payload: ', JSON.stringify(payload));
-    var req = request(payload, function (error, res, body) {
-      debug(error);
+
+    var method = (payload.method || 'get').toLowerCase();
+    url = payload.url;
+
+    if (payload.qs) {
+      url = url + '?' + querystring.stringify(payload.qs);
+      delete payload.qs;
+    }
+
+    var options = {
+      json: payload.json,
+      headers: payload.headers,
+      follow_max: 5,
+    };
+
+    needle.request(method, url, bodyStream, options, function (err, res, body) {
+      debug(err);
       debug('response (%s): ', (res || {}).statusCode, JSON.stringify(body));
-      if (error) {
-        return reject(error);
+      if (err) {
+        return reject(err);
       }
 
       resolve({ res: res, body: body });
     });
-
-    if (body) {
-      bodyStream.pipe(zlib.createGzip()).pipe(req);
-    }
   });
 }
diff --git a/package.json b/package.json
index 4046b66ceb..88022d37d9 100644
--- a/package.json
+++ b/package.json
@@ -40,9 +40,9 @@
     "es6-promise": "^3.0.2",
     "hasbin": "^1.2.3",
     "inquirer": "1.0.3",
+    "needle": "^2.0.1",
     "open": "^0.0.5",
     "os-name": "^1.0.3",
-    "request": "^2.74.0",
     "semver": "^5.1.0",
     "snyk-config": "1.0.1",
     "snyk-go-plugin": "1.2.1",
diff --git a/test/patch-fetch-fail.test.js b/test/patch-fetch-fail.test.js
index ce4e5df29d..7093b59c02 100644
--- a/test/patch-fetch-fail.test.js
+++ b/test/patch-fetch-fail.test.js
@@ -9,40 +9,42 @@ var getPatchFile = proxyquire('../lib/protect/fetch-patch', {
   'then-fs': {
     createWriteStream: function () {},
   },
-  request: function () {
-    return {
-      on: function (_, responseCb) {
-        if (!timeout) {
-          responseCb({ statusCode: 200 });
-        } else {
-          timeout = false;
-          responseCb({ statusCode: 504 });
-        }
-        return {
-          on: function (_, cb) {
-            if (shouldWork) {
-              cb();
-            }
-            return {
-              on: function (_, cb) {
-                if (!shouldWork) {
-                  if (switchAfterFailure) {
-                    shouldWork = !shouldWork;
+  needle: {
+    get: function () {
+      return {
+        on: function (_, responseCb) {
+          if (!timeout) {
+            responseCb({ statusCode: 200 });
+          } else {
+            timeout = false;
+            responseCb({ statusCode: 504 });
+          }
+          return {
+            on: function (_, cb) {
+              if (shouldWork) {
+                cb();
+              }
+              return {
+                on: function (_, cb) {
+                  if (!shouldWork) {
+                    if (switchAfterFailure) {
+                      shouldWork = !shouldWork;
+                    }
+                    cb({
+                      message: 'foo',
+                      code: 'bar',
+                    });
                   }
-                  cb({
-                    message: 'foo',
-                    code: 'bar',
-                  });
-                }
-                return {
-                  pipe: function () {},
-                };
-              },
-            };
-          },
-        };
-      },
-    };
+                  return {
+                    pipe: function () {},
+                  };
+                },
+              };
+            },
+          };
+        },
+      };
+    },
   },
   '../analytics': {
     add: function (type, data) {
diff --git a/test/policy-trust-deep.test.js b/test/policy-trust-deep.test.js
index 67ef438d7e..18ac97c6d9 100644
--- a/test/policy-trust-deep.test.js
+++ b/test/policy-trust-deep.test.js
@@ -3,20 +3,21 @@ var Promise = require('es6-promise').Promise; // jshint ignore:line
 var cli = require('../cli/commands');
 var dir = __dirname + '/fixtures/qs-package';
 
+var originalVulnCount;
+
 test('`snyk test` sees suggested ignore policies', function (t) {
   return cli.test(dir).catch(function (res) {
     var vulns = res.message.toLowerCase();
     t.notEqual(vulns.indexOf('suggests ignoring this issue, with reason: test trust policies'), -1, 'found suggestion to ignore');
 
-    t.equal(count('vulnerability found', vulns), 25, 'all 25 vulns found');
+    originalVulnCount = (count('vulnerability found', vulns));
   });
 });
 
 test('`snyk test` ignores when applying `--trust-policies`', function (t) {
   return cli.test(dir, { 'trust-policies': true }).catch(function (res) {
-    var vulns = res.message.trim();
-    // note: it's 2 vulns
-    t.equal(count('vulnerability found', vulns), 23, 'only 23 vulns left');
+    var vulnCount = count('vulnerability found', res.message.trim());
+    t.equal(originalVulnCount - vulnCount, 2, '2 vulns ignored');
   });
 });