MalwarePublished 6 Aug 2026Updated 24 Sep 2026

merchantweb-lang-cookie-reset (npm) · Malicious Code

Affects merchantweb-lang-cookie-resetSource GCVE Database

Malicious package : remove merchantweb-lang-cookie-reset and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13449

What to do

Remove merchantweb-lang-cookie-reset from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmerchantweb-lang-cookie-reset	Affected 0.0.6 – 99.99.99 10 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be) package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https://artifacts.yosiroute.com/npm/packet-table-thread-stream`), with no version pin and no integrity hash. The shrinkwrap marks that dependency `hasInstallScript: true`, so on `npm install` npm fetches opaque code from `artifacts.yosiroute.com` and executes its lifecycle scripts on the installer's machine, bypassing npm registry scanning. The wrapper package itself is a disposable shim: index.js is trivial (only re-exports name/version), and package.json metadata is placeholder (`author: Package Registry`, `description: Generated package`, `repo: github.com/example/...`). The package's only functional effect on install is pulling attacker-controlled code from a non-registry host into the installer's dependency tree and running its install scripts.

Impact

This malicious package can lead to arbitrary code execution on any machine that installs it, as it fetches and runs attacker-controlled install scripts from an untrusted external source. This compromises the security of the build or deployment environment, potentially leading to further compromise or persistence. There are no known exploits in the wild at this time.

Defensive guidance

Users should avoid installing merchantweb-lang-cookie-reset and any dependencies that reference non-npm-hosted tarball URLs without integrity verification. Audit package.json and shrinkwrap files for dependencies that fetch code from untrusted external sources and remove or replace them with trusted alternatives. Monitor for updates from the npm security team or package maintainers regarding this threat.

Summary

The merchantweb-lang-cookie-reset npm package declares a sole dependency on packet-table-thread-stream via a direct tarball URL hosted outside the npm registry (https://artifacts.yosiroute.com/npm/packet-table-thread-stream). This dependency is not version pinned and lacks an integrity hash, which means npm installs the package without verifying its contents against a trusted source. The shrinkwrap metadata indicates the dependency has an install script, which npm executes during installation. This behavior allows the attacker to run arbitrary code on the installer's machine, bypassing npm registry scanning and security controls. The merchantweb-lang-cookie-reset package itself is a minimal shim with trivial code and placeholder metadata, designed solely to pull in and execute the malicious dependency.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:18 UTC

Technical details

References

Community reviews