Malicious code in req-parmas-valid (npm)

The 'req-parmas-valid' package is a malicious npm package designed to masquerade as the popular 'request' HTTP client by copying its source code and metadata. It adds a malicious middleware export that, when used, spawns a detached Node.js process executing 'lib/callers.js'. This script performs an HTTPS GET request to a mutable paste hosting service, retrieves a JSON response, extracts the 'Cookie' field, and evaluates it as JavaScript code with full Node.js 'require' capabilities. This design enables arbitrary remote code execution on any system importing and using this middleware, with no integrity verification or pinning of the fetched payload. The only explicitly affected version is 1.0.2.

Any application that imports and uses the middleware from 'req-parmas-valid' version 1.0.2 will execute arbitrary code fetched from a remote, attacker-controlled source. This leads to full remote code execution capabilities, potentially compromising the host system and any data or resources accessible to the application.

No official patch or remediation is indicated. Users should immediately remove and avoid using the 'req-parmas-valid' package, especially version 1.0.2. Replace it with the legitimate 'request' package or other trusted HTTP client libraries. Verify all dependencies for authenticity and avoid packages that impersonate well-known libraries. Monitor for any use of this package in your environment and remove it.