MAL-2026-5988

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/params-valid-js/MAL-2026-5988.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5988
Published
2026-06-17T04:22:54Z
Modified
2026-07-09T09:32:58.074862270Z
Summary
Malicious code in params-valid-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c)

The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate request package (bugs URL http://github.com/request/request/issues, copied copyright header), but its only effective behavior is to launch a remote-code-execution dropper. The default export in index.js is a middleware function whose sole action is to spawn node lib/callers.js as a detached child with stdio: 'ignore' and child.unref(), allowing the dropper to continue running after the parent exits. lib/callers.js shadows process with a local object (const process = { env: { DEV_API_KEY: 'google.com', DEV_SECRET_KEY: 'x-secret-key', DEV_SECRET_VALUE: '_' } }) so what looks like environment configuration is actually a hardcoded fetch target. The script then performs axios.get(src, { headers: { [k]: v } }), reads response.data.Cookie, passes it to new Function.constructor('require', s), and immediately invokes the resulting function with the real require — executing whatever Node code the server returns with full module access. The combination of name/identity impersonation, detached background execution, environment-shadowing obfuscation, and unpinned remote-eval is a clear supply-chain attack: any consumer that loads this package and invokes the middleware export executes attacker-controlled code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-17T05:45:42.075763795Z",
            "source": "amazon-inspector",
            "sha256": "4f0f4f5cc684f7bf7b40af2f6856c7d5865f57c7492da68af6c1c194741a4629",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-006882",
            "modified_time": "2026-06-17T04:22:54Z"
        },
        {
            "import_time": "2026-06-18T19:20:03.356634194Z",
            "source": "amazon-inspector",
            "sha256": "397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c",
            "versions": [
                "1.0.3"
            ],
            "id": "IN-MAL-2026-007028",
            "modified_time": "2026-06-18T19:11:16Z"
        },
        {
            "import_time": "2026-07-09T09:16:41.34930753Z",
            "source": "reversing-labs",
            "sha256": "f1f6fe16075c4c955e26afbb3715827410bb4a14505d75311879b306d42af437",
            "versions": [
                "1.0.0"
            ],
            "id": "RLMA-2026-05203",
            "modified_time": "2026-07-07T13:03:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / params-valid-js

Package

Name
params-valid-js
View open source insights on deps.dev
Purl
pkg:npm/params-valid-js

Affected ranges

Affected versions

1.*
1.0.0
1.0.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "8e01978f70ac545c09b013e6bb2be436f622b56b390281d0375c86421f769a96653eee",
            "sha256": "958ffe8101528203679b0ccfea7dae00f3069f21f87a15d45740bfc183b7a48e",
            "path": "lib/callers.js"
        },
        {
            "tlsh": "87a1648526e373519aebb2d1e81f4229b675d223320e1a7178c587d81f0cc69d3b3dd5",
            "sha256": "356f24fff7af39ef7026879a2c571b3c81ee0ecf880078e24b25be69fe5642d6",
            "path": "index.js"
        },
        {
            "tlsh": "62415620cc6a8c931dc929e5687d5603b1a0a41b8e41bc1d778a638c4f5e46f32b8f2d",
            "sha256": "89c833a7fbb54df1f60658a049f6c22b590048263c2ed1a9eedccfe64bc123ac",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "params-valid-js-1.0.0.tgz",
            "hashes": {
                "sha1": "2571d0dfb830c5c57026818751f72ec713a94676",
                "sha512_sri": "sha512-UGgRKNlZk5LB6jl1fVWCjEbEEzudaH300FB8EMzkixbDlrWB1x2paVFQySa8GmEzKGnl713L51IOqE4JedqVcA=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/params-valid-js/MAL-2026-5988.json"