Malicious code in electron-sessions (npm)
The npm package 'electron-sessions' version 0.1.5 contains heavily obfuscated malicious code that collects Electron/Chromium session data such as cookies and local storage. This data is then uploaded to a Vercel Blob storage controlled by the attacker using an embedded upload SDK. The package masquerades as a generic session utility but executes unauthorized data exfiltration when run via 'npx' or required in code.
AI Analysis
Technical Summary
The 'electron-sessions' npm package (version 0.1.5) includes a single large obfuscated JavaScript bundle that collects session artifacts from Electron or Chromium environments. It uses the '@vercel/blob' SDK to upload the harvested data to an attacker-controlled Vercel Blob endpoint, leveraging a secret token embedded in the package. The package's API surface is minimal and misleading, hiding the data exfiltration functionality. Execution occurs when the package is run or imported, causing the host environment's session data to be sent to the attacker without user consent or awareness.
Potential Impact
Any environment that installs and runs or imports 'electron-sessions' version 0.1.5 risks unauthorized disclosure of sensitive session data including cookies and local storage. This can lead to account compromise, session hijacking, or further attacks leveraging stolen session credentials. The malicious upload is stealthy due to heavy obfuscation and lack of documented upload endpoints, increasing the risk of unnoticed data exfiltration.
Mitigation Recommendations
Do not install or use 'electron-sessions' version 0.1.5. Remove the package from any environments where it is present. Since no patch or fix is available, avoid this package entirely. Use trusted and verified alternatives for session management. Monitor dependency sources carefully to prevent inclusion of malicious packages.
Malicious code in electron-sessions (npm)
Description
The npm package 'electron-sessions' version 0.1.5 contains heavily obfuscated malicious code that collects Electron/Chromium session data such as cookies and local storage. This data is then uploaded to a Vercel Blob storage controlled by the attacker using an embedded upload SDK. The package masquerades as a generic session utility but executes unauthorized data exfiltration when run via 'npx' or required in code.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'electron-sessions' npm package (version 0.1.5) includes a single large obfuscated JavaScript bundle that collects session artifacts from Electron or Chromium environments. It uses the '@vercel/blob' SDK to upload the harvested data to an attacker-controlled Vercel Blob endpoint, leveraging a secret token embedded in the package. The package's API surface is minimal and misleading, hiding the data exfiltration functionality. Execution occurs when the package is run or imported, causing the host environment's session data to be sent to the attacker without user consent or awareness.
Potential Impact
Any environment that installs and runs or imports 'electron-sessions' version 0.1.5 risks unauthorized disclosure of sensitive session data including cookies and local storage. This can lead to account compromise, session hijacking, or further attacks leveraging stolen session credentials. The malicious upload is stealthy due to heavy obfuscation and lack of documented upload endpoints, increasing the risk of unnoticed data exfiltration.
Mitigation Recommendations
Do not install or use 'electron-sessions' version 0.1.5. Remove the package from any environments where it is present. Since no patch or fix is available, avoid this package entirely. Use trusted and verified alternatives for session management. Monitor dependency sources carefully to prevent inclusion of malicious packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14266
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c0acd9273b492523fd
Added to database: 08/19/2026, 13:50:56 UTC
Last enriched: 08/19/2026, 14:24:08 UTC
Last updated: 08/19/2026, 14:24:08 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.