SafeDep
Install GitHub App
Start for Free
SafeDep
Install GitHub App
Start for Free

Summary

Note: This report is updated by a verification record

osv MAL-2026-2526: Malicious code in request-js-validator (npm)

Verification Record

Copy of 'request' library with injected payload. Spawns detached child process that fetches stage-2 and executes via new Function.constructor('require', payload). Same pattern as express-session-js.

Details

Note: This report is updated by a verification record

request-js-validator@1.0.2Malicious
Verified
Analysed at: 10/11/26, 1:36 AM
Source: -
SHA256:
Confidence: High