MalwarePublished 6 Apr 2026Updated 6 Jul 2026

request-js-validator (npm) · Malicious Code

Affects request-js-validatorSource GCVE Database

Malicious package : remove request-js-validator and rotate any secrets on hosts that installed it.

Data as of 7 Jul 2026, 12:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-2526

What to do

Remove request-js-validator from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmrequest-js-validator	Affected =1.0.2 =1.0.4 =1.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Copy of 'request' library with injected payload. Spawns detached child process that fetches stage-2 and executes via new Function.constructor('require', payload). Same pattern as express-session-js. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2d5a657a9a3d02a6e081dad40434d93af76f1015495e2fddb11328d88f453063) The package request-js-validator was found to contain malicious code. ## Source: ghsa-malware (a943c6f68b9badd203b85e98b4997b5f5dfb750e15f13e8f8393e7094b0d4de0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Systems with the affected versions of 'request-js-validator' installed or running are fully compromised. Attackers gain the ability to execute arbitrary code remotely, potentially accessing or exfiltrating all secrets and keys stored on the system. The compromise is severe enough that simply removing the package may not eliminate all malicious components, necessitating credential rotation and potentially full system remediation.

Defensive guidance

Immediate removal of the 'request-js-validator' package versions 1.0.2, 1.0.3, and 1.0.4 is required. All secrets and keys on the compromised system should be rotated from a separate, trusted environment. Due to the high risk of persistent compromise, consider rebuilding the affected systems to ensure complete removal of malicious code.

Summary

The 'request-js-validator' npm package versions 1.0.2, 1.0.3, and 1.0.4 contain malicious code that replicates the legitimate 'request' library but injects a payload that spawns a detached child process. This process fetches a second-stage payload and executes it using JavaScript's Function constructor with 'require', enabling arbitrary code execution. This behavior mirrors previously observed malicious patterns such as those in 'express-session-js'. The package effectively compromises any system on which it is installed or executed, granting attackers full control and access to sensitive information.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Jul 2026, 23:18 UTC

Technical details

References

Community reviews