The npm package 'request-easy-validator' impersonates the popular 'request' package and contains malicious code that enables remote code execution. When its exported middleware function is invoked, it silently spawns a detached Node.js process that fetches and executes attacker-controlled code from a mutable URL. This allows an attacker to execute arbitrary Node.js code with full module access on any server using this package. Multiple specific versions of the package are affected.