params-valid-js@1.0.3

Analysis

params-valid-js@1.0. The package copies the entire 'request' HTTP library as cover (README, request.js, lib/*.js) but injects a hidden implant: index.js spawns a detached child node process running lib/callers.js, which does an HTTP GET to a remote host and executes the response's Cookie field as arbitrary JavaScript via new Function.constructor("require", s). The callers.js file uses a locally-scoped 'process' constant that shadows the real process.env to evade static analysis. The detached spawn (child.unref()) prevents the installer from observing the child's failure. No lifecycle hooks are needed — the implant activates when the package is required as middleware.