The 'request-easy-validator' npm package is a malicious clone of the legitimate 'request' package. Its main module exports a middleware function that, upon invocation, launches a detached child Node.js process running 'lib/callers.js'. This child process makes an HTTPS GET request to an attacker-controlled paste host URL with a secret header, retrieves a '.Cookie' field from the response, and executes it as Node.js code using 'new Function.constructor' with live 'require' access. Because the payload URL is mutable, the attacker can change the executed code at any time without republishing the package, enabling persistent arbitrary remote code execution on any system using these versions of the package.

Any server or environment that installs and runs the affected versions of 'request-easy-validator' and invokes its middleware function is vulnerable to arbitrary remote code execution controlled by the attacker. This can lead to full compromise of the host system, data theft, or further malicious activity. The attacker can update the payload at will, maintaining persistent control without needing to update the package itself.

No official patch or remediation is currently documented. Users should immediately remove 'request-easy-validator' from their dependencies and replace it with the legitimate 'request' package or a trusted alternative. Avoid invoking the middleware function from this package. Monitor for any unexpected child processes or network requests to suspicious external URLs. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.