The merchantweb-lang-cookie-reset npm package declares a sole dependency on packet-table-thread-stream via a direct tarball URL hosted outside the npm registry (https://artifacts.yosiroute.com/npm/packet-table-thread-stream). This dependency is not version pinned and lacks an integrity hash, which means npm installs the package without verifying its contents against a trusted source. The shrinkwrap metadata indicates the dependency has an install script, which npm executes during installation. This behavior allows the attacker to run arbitrary code on the installer's machine, bypassing npm registry scanning and security controls. The merchantweb-lang-cookie-reset package itself is a minimal shim with trivial code and placeholder metadata, designed solely to pull in and execute the malicious dependency.

This malicious package can lead to arbitrary code execution on any machine that installs it, as it fetches and runs attacker-controlled install scripts from an untrusted external source. This compromises the security of the build or deployment environment, potentially leading to further compromise or persistence. There are no known exploits in the wild at this time.

No official patch or remediation is currently documented. Users should avoid installing merchantweb-lang-cookie-reset and any dependencies that reference non-npm-hosted tarball URLs without integrity verification. Audit package.json and shrinkwrap files for dependencies that fetch code from untrusted external sources and remove or replace them with trusted alternatives. Monitor for updates from the npm security team or package maintainers regarding this threat.