The cookie-parser-legacy npm package is a malicious clone of the popular cookie-parser Express middleware. It substitutes the legitimate 'cookie-signature' dependency with a malicious package named 'moustick' pinned to the mutable 'latest' tag, enabling execution of arbitrary code controlled by the attacker during installation and runtime. The presence of 'execSync' import without legitimate use further suggests capability for arbitrary command execution. This malicious package executes code on user-supplied cookie values using secrets from the host environment, leading to full system compromise. The package versions 1.5.1 through 1.5.4 are affected. Because the package name closely mimics a trusted library, users may inadvertently install it, exposing their systems to severe risk.

Any system with cookie-parser-legacy versions 1.5.1 to 1.5.4 installed is considered fully compromised. The malicious package can execute arbitrary code during installation and runtime, potentially exposing all secrets and keys on the system. Attackers may gain full control over the affected system. Rotating all secrets and keys is necessary after compromise. Removal of the package alone does not guarantee full remediation due to possible persistence of malicious artifacts.

No official patch or fix is available for this malicious package. Immediate removal of cookie-parser-legacy versions 1.5.1 through 1.5.4 is required. All secrets and keys on affected systems should be rotated from a clean, uncompromised environment. Users should verify dependencies carefully and avoid installing packages that impersonate well-known libraries. Monitor for any signs of persistent compromise and consider full system reimaging if necessary.