request-js-validator@1.0.2

Analysis

Combosquat package request-js-validator impersonates the deprecated request package (same README, false bugs URL pointing to github[.]com/request/request). When imported, index.js spawns a detached background Node process that runs lib/callers.js. That script makes an HTTPS GET to jsonkeeper[.]com/b/XB9WY and passes the fetched content to new Function.constructor('require', responseBody) — evaluating arbitrary remote code with full Node.js require() access, making it a remote code execution dropper. The C2 host is www[.]jsonkeeper[.]com, path /b/XB9WY. No lifecycle hooks needed; triggers silently on require(). The remote second stage has complete access to the victim environment including files, credentials, and tokens.