MAL-2026-10410

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-phase/MAL-2026-10410.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10410
Published
2026-07-13T06:48:44Z
Modified
2026-07-13T07:47:02.066396364Z
Summary
Malicious code in cookie-phase (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c)

The package presents itself as the popular pino logger (README badges, exported module.exports.pino = middleware) but its name and metadata are unrelated. When a consumer imports the package and invokes the default export as middleware, index.js spawns a detached node child running lib/initializeCaller.js. That child hides the C2 destination inside base64 constants placed in a fake local process.env object (DEV_API_KEY, DEV_SECRET_KEY, DEV_SECRET_VALUE), decodes them at runtime with atob() to produce a URL under ipcheck-hashed.vercel.app/api/auth/..., POSTs to it via axios, and passes the response body directly to new Function('require', response.data)(require). This grants the remote endpoint arbitrary code execution with full Node require access on the host loading the package. The base64 obfuscation of the destination URL and the impersonation of a well-known logger are consistent with a dropper designed to compromise developer and build-system machines that install the package expecting pino.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-13T06:48:44Z",
            "id": "IN-MAL-2026-009828",
            "versions": [
                "2.3.5"
            ],
            "source": "amazon-inspector",
            "sha256": "17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c",
            "import_time": "2026-07-13T07:40:11.530796583Z"
        }
    ]
}
References
Credits

Affected packages

npm / cookie-phase

Package

Name
cookie-phase
View open source insights on deps.dev
Purl
pkg:npm/cookie-phase

Affected ranges

Affected versions

2.*
2.3.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-phase/MAL-2026-10410.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df",
            "sha256": "fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad",
            "path": "lib/initializeCaller.js"
        },
        {
            "tlsh": "0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7",
            "path": "index.js",
            "sha256": "1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-lr7Nr9bts/JvI0tpJghUIRNyRNUyFLo5CASnqpmbz/BSPCJuFUxeCtRnBvGXNkdJv/5pkFscPcHVqIJzwiXYzg==",
                "sha1": "d99be80c0d3fed7e4dcc8cccb01f0959e144912a"
            },
            "filename": "cookie-phase-2.3.5.tgz"
        }
    ]
}