cookie-js-ease (npm) · Malicious Code
Affects cookie-js-easeSource GCVE Database
Malicious package : remove cookie-js-ease and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:15 UTC
Malicious package
Published to npm · OSV MAL-2026-10058
What to do
Remove cookie-js-ease from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcookie-js-ease | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package cookie-js-ease@2.1.7 impersonates the popular js-cookie library but contains malicious code that executes attacker-controlled JavaScript in Node.js environments. When the package's Cookies.set() or Cookies.remove() functions are called in Node.js or with expires set to 0, it fetches and evaluates remote code from a hidden URL, enabling remote code execution. This malicious behavior is specific to the CommonJS build and does not affect the .mjs or .min.js variants. This is a typosquatting attack combined with remote code execution targeting developers who mistakenly install this package instead of the legitimate js-cookie library.