# MAL-2026-5991: Malicious code in req-parmas-valid (npm)


- **Type:** Malicious package
- **Package:** `req-parmas-valid` (npm)
- **Published:** 17 Jun 2026
- **Also known as:** GHSA-3pgv-795j-3ggc

## What is MAL-2026-5991?

MAL-2026-5991 is a malicious package in req-parmas-valid, published on 17 Jun 2026. 

### Official description

Package name `req-parmas-valid` impersonates the well-known `request` HTTP client (description copied verbatim as 'Simplified HTTP request client.', `bugs.url` points at `github.com/request/request/issues`, README and most source copied from upstream). Bolted onto the copied source is a malicious `middleware` export (also exposed as `reqValidator` and the package's default export) which spawns a detached `node lib/callers.js` child process. `lib/callers.js` performs an HTTPS GET to `https://www.jsonkeeper.com/b/DDC6J` (an anonymous, mutable paste host), reads the `Cookie` field of the JSON response, and evaluates it via `new Function.constructor("require", s)(require)` — handing the fetched bytes full Node `require` capability with no integrity check, no pinning, and a payload host completely alien to the package's advertised purpose. Any consumer that imports and uses the middleware (the obvious Express-style API shape) executes arbitrary remote code controlled by whoever currently owns the paste.

## What should I do about MAL-2026-5991?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5991 is a malicious package: req-parmas-valid (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5991/ (Markdown: https://insights.sbomify.com/MAL-2026-5991/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5991

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5991/
Summaries are generated and may contain mistakes; the official description above is the record.