params-valid-js

{"schema_version":"1.7.4","id":"MAL-2026-5988","published":"2026-06-17T04:22:54Z","modified":"2026-09-01T11:20:28.917237856Z","aliases":["GHSA-4mh2-8f67-ph3q"],"summary":"Malicious code in params-valid-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c)\nThe package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate `request` package (bugs URL `http://github.com/request/request/issues`, copied copyright header), but its only effective behavior is to launch a remote-code-execution dropper. The default export in `index.js` is a `middleware` function whose sole action is to spawn `node lib/callers.js` as a detached child with `stdio: 'ignore'` and `child.unref()`, allowing the dropper to continue running after the parent exits. `lib/callers.js` shadows `process` with a local object (`const process = { env: { DEV_API_KEY: 'google.com', DEV_SECRET_KEY: 'x-secret-key', DEV_SECRET_VALUE: '_' } }`) so what looks like environment configuration is actually a hardcoded fetch target. The script then performs `axios.get(src, { headers: { [k]: v } })`, reads `response.data.Cookie`, passes it to `new Function.constructor('require', s)`, and immediately invokes the resulting function with the real `require` — executing whatever Node code the server returns with full module access. The combination of name/identity impersonation, detached background execution, environment-shadowing obfuscation, and unpinned remote-eval is a clear supply-chain attack: any consumer that loads this package and invokes the middleware export executes attacker-controlled code.\n","affected":[{"package":{"name":"params-valid-js","ecosystem":"npm"},"versions":["1.0.0","1.0.3","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/callers.js","sha256":"958ffe8101528203679b0ccfea7dae00f3069f21f87a15d45740bfc183b7a48e","tlsh":"8e01978f70ac545c09b013e6bb2be436f622b56b390281d0375c86421f769a96653eee"},{"path":"index.js","sha256":"356f24fff7af39ef7026879a2c571b3c81ee0ecf880078e24b25be69fe5642d6","tlsh":"87a1648526e373519aebb2d1e81f4229b675d223320e1a7178c587d81f0cc69d3b3dd5"},{"path":"package.json","sha256":"89c833a7fbb54df1f60658a049f6c22b590048263c2ed1a9eedccfe64bc123ac","tlsh":"62415620cc6a8c931dc929e5687d5603b1a0a41b8e41bc1d778a638c4f5e46f32b8f2d"}],"package_integrity":[{"filename":"params-valid-js-1.0.0.tgz","hashes":{"sha1":"2571d0dfb830c5c57026818751f72ec713a94676","sha512_sri":"sha512-UGgRKNlZk5LB6jl1fVWCjEbEEzudaH300FB8EMzkixbDlrWB1x2paVFQySa8GmEzKGnl713L51IOqE4JedqVcA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/params-valid-js/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/params-valid-js/v/1.0.3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4mh2-8f67-ph3q"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-006882","import_time":"2026-06-17T05:45:42.075763795Z","modified_time":"2026-06-17T04:22:54Z","sha256":"4f0f4f5cc684f7bf7b40af2f6856c7d5865f57c7492da68af6c1c194741a4629","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-007028","import_time":"2026-06-18T19:20:03.356634194Z","modified_time":"2026-06-18T19:11:16Z","sha256":"397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c","source":"amazon-inspector","versions":["1.0.3"]},{"id":"RLMA-2026-05203","import_time":"2026-07-09T09:16:41.34930753Z","modified_time":"2026-07-07T13:03:21Z","sha256":"f1f6fe16075c4c955e26afbb3715827410bb4a14505d75311879b306d42af437","source":"reversing-labs","versions":["1.0.0"]},{"id":"RLUA-2026-05590","import_time":"2026-07-20T13:15:03.393124461Z","modified_time":"2026-07-20T10:53:25Z","sha256":"22b041d947d7c306c08bdbba317f085958b61847f44e98bf79b0159e16cf47a4","source":"reversing-labs","versions":["1.0.3","1.0.1"]},{"id":"RLUA-2026-06362","import_time":"2026-09-01T11:18:14.58082892Z","modified_time":"2026-08-24T17:03:15Z","sha256":"55aea767366333d6b3d78998446aed171d1fc0ec06cbec5ee4c437259306c1c0","source":"reversing-labs"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}