MAL-2026-10060: Malicious code in cookie-parser-js (npm)
The cookie-parser-js package on npm is a malicious package impersonating the popular cookie-parser middleware by copying its metadata and description. It declares a runtime dependency on a fabricated package, cookie-js-ease, pinned to the mutable 'latest' tag, allowing the attacker to push arbitrary code at any time. This design enables remote code execution in any application that installs and uses cookie-parser-js. The attack targets developers who mistype the package name, leveraging name similarity and stolen identity to trick users.
AI Analysis
Technical Summary
cookie-parser-js is a malicious npm package that impersonates the legitimate cookie-parser middleware by copying author metadata, descriptions, and repository identifiers. It declares an undocumented runtime dependency on cookie-js-ease, a fabricated package pinned to the mutable 'latest' tag, which is loaded and executed when the middleware is invoked. This setup allows the attacker to execute arbitrary code in any consumer application using cookie-parser-js. The attack relies on typosquatting and identity theft to confuse developers into installing the malicious package instead of the legitimate one.
Potential Impact
Any application that installs and uses cookie-parser-js versions 1.0.8, 1.4.8, 1.4.9, or 1.5.0 is at risk of arbitrary code execution due to the malicious runtime dependency on cookie-js-ease. This can lead to full compromise of the affected application environment.
Mitigation Recommendations
No official patch or remediation is currently available for cookie-parser-js. Users should immediately verify their dependencies to ensure they are using the legitimate cookie-parser package and remove any installations of cookie-parser-js. Avoid installing packages with similar names to popular libraries without verifying their authenticity. Monitor package sources carefully and prefer packages with verified maintainers.
MAL-2026-10060: Malicious code in cookie-parser-js (npm)
Description
The cookie-parser-js package on npm is a malicious package impersonating the popular cookie-parser middleware by copying its metadata and description. It declares a runtime dependency on a fabricated package, cookie-js-ease, pinned to the mutable 'latest' tag, allowing the attacker to push arbitrary code at any time. This design enables remote code execution in any application that installs and uses cookie-parser-js. The attack targets developers who mistype the package name, leveraging name similarity and stolen identity to trick users.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
cookie-parser-js is a malicious npm package that impersonates the legitimate cookie-parser middleware by copying author metadata, descriptions, and repository identifiers. It declares an undocumented runtime dependency on cookie-js-ease, a fabricated package pinned to the mutable 'latest' tag, which is loaded and executed when the middleware is invoked. This setup allows the attacker to execute arbitrary code in any consumer application using cookie-parser-js. The attack relies on typosquatting and identity theft to confuse developers into installing the malicious package instead of the legitimate one.
Potential Impact
Any application that installs and uses cookie-parser-js versions 1.0.8, 1.4.8, 1.4.9, or 1.5.0 is at risk of arbitrary code execution due to the malicious runtime dependency on cookie-js-ease. This can lead to full compromise of the affected application environment.
Mitigation Recommendations
No official patch or remediation is currently available for cookie-parser-js. Users should immediately verify their dependencies to ensure they are using the legitimate cookie-parser package and remove any installations of cookie-parser-js. Avoid installing packages with similar names to popular libraries without verifying their authenticity. Monitor package sources carefully and prefer packages with verified maintainers.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10060
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba9768715ace435825d3
Added to database: 07/10/2026, 09:25:43 UTC
Last enriched: 07/10/2026, 10:11:11 UTC
Last updated: 07/10/2026, 10:11:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.