{"answers":{"affected":"1 open source package ship an affected version, including req-parmas-valid.","exploited":"There is no known exploitation of MAL-2026-5991 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-5991 is a malicious package in req-parmas-valid, published on 17 Jun 2026."},"fix_prompt":"MAL-2026-5991 is a malicious package: req-parmas-valid (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-5991/ (Markdown: https://insights.sbomify.com/MAL-2026-5991/index.md)","id":"MAL-2026-5991","markdown":"https://insights.sbomify.com/MAL-2026-5991/index.md","name":"MAL-2026-5991","record":{"aliases":["GHSA-3pgv-795j-3ggc"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name `req-parmas-valid` impersonates the well-known `request` HTTP client (description copied verbatim as 'Simplified HTTP request client.', `bugs.url` points at `github.com/request/request/issues`, README and most source copied from upstream). Bolted onto the copied source is a malicious `middleware` export (also exposed as `reqValidator` and the package's default export) which spawns a detached `node lib/callers.js` child process. `lib/callers.js` performs an HTTPS GET to `https://www.jsonkeeper.com/b/DDC6J` (an anonymous, mutable paste host), reads the `Cookie` field of the JSON response, and evaluates it via `new Function.constructor(\"require\", s)(require)` — handing the fetched bytes full Node `require` capability with no integrity check, no pinning, and a payload host completely alien to the package's advertised purpose. Any consumer that imports and uses the middleware (the obvious Express-style API shape) executes arbitrary remote code controlled by whoever currently owns the paste.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in req-parmas-valid (npm)","id":"MAL-2026-5991","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"req-parmas-valid","purl":"pkg:npm/req-parmas-valid","source":"MAL-2026-5991"}],"products":null,"published":"2026-06-17","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-5991/"}