The 'request-js-validator' npm package versions 1.0.2, 1.0.3, and 1.0.4 contain malicious code that replicates the legitimate 'request' library but injects a payload that spawns a detached child process. This process fetches a second-stage payload and executes it using JavaScript's Function constructor with 'require', enabling arbitrary code execution. This behavior mirrors previously observed malicious patterns such as those in 'express-session-js'. The package effectively compromises any system on which it is installed or executed, granting attackers full control and access to sensitive information.

Systems with the affected versions of 'request-js-validator' installed or running are fully compromised. Attackers gain the ability to execute arbitrary code remotely, potentially accessing or exfiltrating all secrets and keys stored on the system. The compromise is severe enough that simply removing the package may not eliminate all malicious components, necessitating credential rotation and potentially full system remediation.

No official patch or fix is available for this malicious package. Immediate removal of the 'request-js-validator' package versions 1.0.2, 1.0.3, and 1.0.4 is required. All secrets and keys on the compromised system should be rotated from a separate, trusted environment. Due to the high risk of persistent compromise, consider rebuilding the affected systems to ensure complete removal of malicious code.