Malicious code in requests-middleware (npm)

The 'requests-middleware' npm package (version 1.0.2) masquerades as a legitimate HTTP library by copying the original project's README, dependencies, and source files but includes a malicious dropper. Its exported middleware function detaches and silently runs a child process that fetches JavaScript payloads from 'https://www.jsonkeeper.com/b/YL7GN', extracting the payload from the HTTP response's Cookie field. This payload is evaluated with full require access, allowing arbitrary remote code execution. The remote URL is disguised as a fake environment variable to evade detection. Because the payload is hosted on an anonymous, mutable paste service, the executed code can change at any time without updating the package.

Any application importing and invoking the 'requests-middleware' package's default middleware function will execute attacker-controlled JavaScript code with full require privileges. This can lead to arbitrary code execution within the application context, potentially compromising the host system and data confidentiality, integrity, and availability.

No official patch or remediation is currently available for this malicious package. Users should immediately remove 'requests-middleware' version 1.0.2 from their dependencies and avoid installing similarly named typosquat packages. Verify package authenticity before installation and rely on official, well-maintained libraries. Monitor for updates from the package registry or security advisories for further guidance.