electron-sessions

{"modified":"2026-08-19T06:17:26Z","published":"2026-08-19T06:17:26Z","schema_version":"1.7.4","id":"MAL-2026-14266","summary":"Malicious code in electron-sessions (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769)\nPackage published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated `dist/index.js` (javascript-obfuscator with rotating string-array of length 4399, control-flow flattening, self-defending wrapper, dead-code injection) as both `main` and `bin`. The bundle contains plaintext substrings `chrome`, `cookies`, `electron` alongside an import of the `@vercel/blob` upload SDK (declared runtime dependency `@vercel/blob: ^2.6.1`), whose primary API uploads arbitrary bytes to a Vercel Blob store held by whoever controls the `BLOB_READ_WRITE_TOKEN`. Package naming targets Electron/Chromium session artifacts (cookies, Local Storage/leveldb, Login Data), the README exposes only a one-line `new Sessions()` cover-story API with no documented upload endpoint or caller-configurable destination, and the upload SDK has no legitimate purpose in a generic session-utilities library. Any process that runs `npx electron-sessions` or `require('electron-sessions')` executes the obfuscated bundle against its own host, and collected session data is shipped to an author-controlled Vercel Blob endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"electron-sessions"},"versions":["0.1.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"83ff80d3489158b7200b4de2ef765ee8e865a453f3f378b4d53d8643248438f5","tlsh":"8d45536063c0ac53200f0fa3bf19fae5ed2d6e79b45119cbd560be58a6b9807c5e09f1"}],"package_integrity":[{"filename":"electron-sessions-0.1.5.tgz","hashes":{"sha1":"5b54d60a8ae82962f02cfc795ff57cc8028adac7","sha512_sri":"sha512-xLsCjiIZzU9/Xnkn1y919Fg3Z1MciGzZSV/zLOwLB3wNvN4Vgn21WXVUx0i8H/1iSefP4nKMd3BxkQDUqrs1QQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/electron-sessions/v/0.1.5"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018378","import_time":"2026-08-19T06:49:44.1620261Z","modified_time":"2026-08-19T06:17:26Z","sha256":"cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769","source":"amazon-inspector","versions":["0.1.5"]}]}}