request-easy-validator (npm) · Malicious Code
Affects request-easy-validatorSource GCVE Database
Rated by Threat Radar
Data as of 8 Sep 2026, 12:40 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmrequest-easy-validatorpkg:npm/request-easy-validatorOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should immediately remove 'request-easy-validator' from their dependencies and replace it with the legitimate 'request' package or a trusted alternative. Avoid invoking the middleware function from this package. Monitor for any unexpected child processes or network requests to suspicious external URLs.
Description
The npm package 'request-easy-validator' impersonates the popular 'request' package and contains malicious code that enables remote code execution. When its exported middleware function is invoked, it silently spawns a detached Node.js process that fetches and executes attacker-controlled code from a mutable URL. This allows an attacker to execute arbitrary Node.js code with full module access on any server using this package. Multiple specific versions of the package are affected.