Malicious code in params-valid-js (npm)

The 'params-valid-js' npm package, posing as a simplified HTTP request client and copying identity metadata from the legitimate 'request' package, contains malicious code designed to execute arbitrary code remotely. The middleware function in 'index.js' launches a detached child process running 'lib/callers.js', which shadows the process environment with hardcoded values and fetches code from a remote server using axios. The fetched code is then executed dynamically using 'new Function.constructor', granting full Node.js module access to the attacker-controlled code. This behavior constitutes a supply-chain attack where any consumer invoking the middleware runs attacker-controlled code.

Any application that installs and invokes the middleware export of the affected 'params-valid-js' package versions will execute arbitrary attacker-controlled code with full Node.js module privileges. This can lead to complete system compromise, data theft, or further malware deployment. The attack leverages supply-chain trust by impersonating a legitimate package and running code in a detached background process, making detection and mitigation more difficult.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove 'params-valid-js' versions 1.0.0, 1.0.1, and 1.0.3 from their dependencies and avoid installing or using this package. Verify dependencies and lockfiles to ensure this package is not included transitively. Monitor package sources carefully to avoid supply-chain attacks. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.