[email protected] is a malicious npm package that impersonates the legitimate js-cookie library by copying its repository URL, banner comment, API surface, and author name. It adds axios and request as runtime dependencies and injects a remote code execution payload in its CommonJS build (dist/cookie.ease.js). When the Cookies.set() or Cookies.remove() methods are invoked in a Node.js context or with expires=0, the package performs a base64-decoded HTTP GET request to https://cookie-api-two.vercel.app/, retrieves JavaScript code, and executes it via eval() within the Node.js process. This code execution is attacker-controlled, enabling full compromise of the environment using this package. The attack is concealed by targeting only the CommonJS variant and obfuscating the URL to evade static detection. This is a clear case of typosquatting combined with remote code execution.

Consumers who mistakenly install [email protected] instead of the legitimate js-cookie package and use its Cookies.set() or Cookies.remove() functions in Node.js environments are subject to remote code execution. This allows attackers to execute arbitrary code within the victim's Node.js process, potentially leading to full system compromise, data theft, or further malicious activity. The impact is severe for affected users due to the direct execution of attacker-controlled code.

No official patch or remediation is currently available for [email protected]. Users should avoid installing or using this package entirely. Verify package names carefully before installation to avoid typosquatting attacks, and prefer the legitimate js-cookie package. If [email protected] is detected in any environment, remove it immediately and audit the system for potential compromise. Monitor package sources and use tools that detect typosquatting and malicious packages.