Malicious code in clx-cookieparser (npm)
The 'clx-cookieparser' npm package is a malicious lookalike of the legitimate 'cookie-parser' middleware. It copies the original code but falsely claims a repository affiliation that does not exist, causing potential confusion for developers. Although the package itself does not perform network I/O or contain obfuscated or credential-stealing code, its installation is considered highly dangerous as it may lead to full system compromise. Immediate removal and secret/key rotation are advised if installed.
AI Analysis
Technical Summary
The 'clx-cookieparser' package on npm is a malicious clone of the Express 'cookie-parser' middleware, repackaged under a different name with a fake repository attribution to mislead developers. The code reimplements cookie-parser functionality without network activity or obfuscation, but the package is flagged as malicious by security sources. Installing this package can result in full compromise of the host system, necessitating urgent remediation actions.
Potential Impact
Installation of 'clx-cookieparser' can lead to full system compromise. Any secrets or keys stored on the affected machine should be considered exposed and must be rotated immediately. Removing the package alone may not fully remediate the compromise due to potential persistence of other malicious components.
Mitigation Recommendations
Remove the 'clx-cookieparser' package immediately if installed. Rotate all secrets and keys from a secure, uncompromised environment. Conduct a thorough security assessment of the affected system to identify and remediate any additional malicious artifacts. No official patch or fix is indicated; remediation relies on removal and secret rotation.
Malicious code in clx-cookieparser (npm)
Description
The 'clx-cookieparser' npm package is a malicious lookalike of the legitimate 'cookie-parser' middleware. It copies the original code but falsely claims a repository affiliation that does not exist, causing potential confusion for developers. Although the package itself does not perform network I/O or contain obfuscated or credential-stealing code, its installation is considered highly dangerous as it may lead to full system compromise. Immediate removal and secret/key rotation are advised if installed.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'clx-cookieparser' package on npm is a malicious clone of the Express 'cookie-parser' middleware, repackaged under a different name with a fake repository attribution to mislead developers. The code reimplements cookie-parser functionality without network activity or obfuscation, but the package is flagged as malicious by security sources. Installing this package can result in full compromise of the host system, necessitating urgent remediation actions.
Potential Impact
Installation of 'clx-cookieparser' can lead to full system compromise. Any secrets or keys stored on the affected machine should be considered exposed and must be rotated immediately. Removing the package alone may not fully remediate the compromise due to potential persistence of other malicious components.
Mitigation Recommendations
Remove the 'clx-cookieparser' package immediately if installed. Rotate all secrets and keys from a secure, uncompromised environment. Conduct a thorough security assessment of the affected system to identify and remediate any additional malicious artifacts. No official patch or fix is indicated; remediation relies on removal and secret rotation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6661
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-jpg2-3r22-63v7"]
- Ecosystems
- ["npm"]
Threat ID: 6a42ed4b27e9c79719935d2d
Added to database: 06/29/2026, 22:10:19 UTC
Last enriched: 09/12/2026, 21:31:45 UTC
Last updated: 09/13/2026, 18:54:39 UTC
Views: 406
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.