MAL-2026-10411

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-sign/MAL-2026-10411.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10411
Published
2026-07-13T06:48:33Z
Modified
2026-07-13T07:47:02.068558239Z
Summary
Malicious code in cookie-sign (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f)

The package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a detached child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL (https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the caller's entire process.env to it, and passes the HTTP response body to new Function('require', response.data) for immediate execution. This yields two attacker gains against the installer: exfiltration of all environment variables (which in CI/production typically hold cloud credentials, tokens, and secrets) and remote code execution in the installer's Node process using code returned by the attacker-controlled server. The C2 URL is base64-obfuscated and stored under a decoy DEV_API_KEY field, and the package name misrepresents its purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f",
            "modified_time": "2026-07-13T06:48:33Z",
            "versions": [
                "2.3.5"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009827",
            "import_time": "2026-07-13T07:40:11.421315491Z"
        }
    ]
}
References
Credits

Affected packages

npm / cookie-sign

Package

Name
cookie-sign
View open source insights on deps.dev
Purl
pkg:npm/cookie-sign

Affected ranges

Affected versions

2.*
2.3.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-3mDTjJyOE1f/HZ/su0mc/Dn7GNnAo4zRlnnIXvQnCYJnD1g81vc0895cGGY4ckzUt+UPNwI8gf1Ou5PuJZRBQA==",
                "sha1": "e1b5855441a6d8c363f54455a7a9bf19545fe893"
            },
            "filename": "cookie-sign-2.3.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad",
            "tlsh": "f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df",
            "path": "lib/initializeCaller.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cookie-sign/MAL-2026-10411.json"