cookie-sign

{"modified":"2026-07-13T06:48:33Z","published":"2026-07-13T06:48:33Z","schema_version":"1.7.4","id":"MAL-2026-10411","summary":"Malicious code in cookie-sign (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f)\nThe package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a detached child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL (https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df), POSTs the caller's entire process.env to it, and passes the HTTP response body to `new Function('require', response.data)` for immediate execution. This yields two attacker gains against the installer: exfiltration of all environment variables (which in CI/production typically hold cloud credentials, tokens, and secrets) and remote code execution in the installer's Node process using code returned by the attacker-controlled server. The C2 URL is base64-obfuscated and stored under a decoy `DEV_API_KEY` field, and the package name misrepresents its purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"cookie-sign"},"versions":["2.3.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/initializeCaller.js","sha256":"fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad","tlsh":"f921f38e15fe101d066751e6bb2f24027022e8133946d4a47bcc835b1fc966e99936df"}],"package_integrity":[{"filename":"cookie-sign-2.3.5.tgz","hashes":{"sha1":"e1b5855441a6d8c363f54455a7a9bf19545fe893","sha512_sri":"sha512-3mDTjJyOE1f/HZ/su0mc/Dn7GNnAo4zRlnnIXvQnCYJnD1g81vc0895cGGY4ckzUt+UPNwI8gf1Ou5PuJZRBQA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cookie-sign/v/2.3.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-009827","import_time":"2026-07-13T07:40:11.421315491Z","modified_time":"2026-07-13T06:48:33Z","sha256":"8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f","source":"amazon-inspector","versions":["2.3.5"]}]}}