cookie-parser-es (npm) · Malicious Code
Affects cookie-parser-esSource GCVE Database
Malicious package : remove cookie-parser-es and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:15 UTC
Malicious package
Published to npm · OSV MAL-2026-10059
What to do
Remove cookie-parser-es from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcookie-parser-es | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'cookie-parser-es' version 1.0.7 is a malicious typosquatting package impersonating the popular 'cookie-parser' middleware. It copies metadata and author information from the legitimate package to deceive users. The package loads an undeclared dependency 'cookie-ease' at runtime, which executes code immediately when the middleware is used. Additionally, it declares a mutable dependency 'set-cookie-ease' pinned to 'latest', allowing the attacker to change the payload after initial scans. This behavior matches a supply-chain attack pattern designed to execute malicious code in dependent projects.