The 'cookie-sign' npm package version 2.3.5 contains embedded malicious code that, during installation, spawns a detached child process running a script which base64-decodes a hardcoded command-and-control URL. This script POSTs the entire process environment variables to the attacker-controlled endpoint and executes the returned JavaScript code dynamically via the Function constructor, enabling remote code execution in the installer's Node.js environment. This results in exfiltration of sensitive environment variables and arbitrary code execution. The malicious URL is concealed under a decoy environment variable named 'DEV_API_KEY', and the package name is deceptive, purporting to be a cookie-signing or Express middleware utility.

Successful installation of this package leads to exfiltration of all environment variables from the victim's process, potentially exposing cloud credentials, tokens, and secrets commonly stored in CI or production environments. Additionally, the attacker gains the ability to execute arbitrary code remotely within the victim's Node.js process, posing a severe risk of system compromise and further malicious activity.

No official patch or remediation is currently documented. Users should avoid installing the 'cookie-sign' package version 2.3.5. Verify package authenticity before installation and consider using trusted package sources or alternatives. Monitor for any updates or advisories from npm or security vendors regarding this package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.