Note: This report is updated by a verification record
osv MAL-2026-2526: Malicious code in request-js-validator (npm)
Copy of 'request' library with injected payload. Spawns detached child process that fetches stage-2 and executes via new Function.constructor('require', payload). Same pattern as express-session-js.
Note: This report is updated by a verification record