cookie-phase

{"modified":"2026-07-13T06:48:44Z","published":"2026-07-13T06:48:44Z","schema_version":"1.7.4","id":"MAL-2026-10410","summary":"Malicious code in cookie-phase (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c)\nThe package presents itself as the popular `pino` logger (README badges, exported `module.exports.pino = middleware`) but its name and metadata are unrelated. When a consumer imports the package and invokes the default export as middleware, `index.js` spawns a detached `node` child running `lib/initializeCaller.js`. That child hides the C2 destination inside base64 constants placed in a fake local `process.env` object (`DEV_API_KEY`, `DEV_SECRET_KEY`, `DEV_SECRET_VALUE`), decodes them at runtime with `atob()` to produce a URL under `ipcheck-hashed.vercel.app/api/auth/...`, POSTs to it via axios, and passes the response body directly to `new Function('require', response.data)(require)`. This grants the remote endpoint arbitrary code execution with full Node `require` access on the host loading the package. The base64 obfuscation of the destination URL and the impersonation of a well-known logger are consistent with a dropper designed to compromise developer and build-system machines that install the package expecting `pino`.\n","affected":[{"package":{"ecosystem":"npm","name":"cookie-phase"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad","tlsh":"f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df"},{"path":"index.js","sha256":"1f51184c197102444a2c8a23e4a8e54a6479750420512922fcb5d5f795c33911","tlsh":"0f318545b5f21259126d98c4f6b4a5263cdf9437331b76b1cded93952bce2080032bc7"}],"package_integrity":[{"filename":"cookie-phase-2.3.5.tgz","hashes":{"sha1":"d99be80c0d3fed7e4dcc8cccb01f0959e144912a","sha512_sri":"sha512-lr7Nr9bts/JvI0tpJghUIRNyRNUyFLo5CASnqpmbz/BSPCJuFUxeCtRnBvGXNkdJv/5pkFscPcHVqIJzwiXYzg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cookie-phase/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009828","import_time":"2026-07-13T07:40:11.530796583Z","modified_time":"2026-07-13T06:48:44Z","sha256":"17bfab347de8288575bca9677b9eb7652b0024cdbffc1efebe387378c243299c","source":"amazon-inspector","versions":["2.3.5"]}]}}