MalwarePublished 5 Aug 2026

the-search · Malicious Code

Affects the-searchSource GCVE Database

Malicious package : remove the-search and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 15:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12810

What to do

Remove the-search from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmthe-search	Affected =1.0.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd) The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-created hidden form POST to a hardcoded webhook.site endpoint (https://webhook.site/86b505ff-4280-459f-9b36-e765825c0ada). The package has no legitimate declared purpose consistent with this behavior; bundling this module into a web application causes visitor cookies to be sent to an attacker-controlled destination. The base64 wrapping around the JSON body is minor evasion to obscure the exfiltrated content in network logs.

Impact

Any web application that includes the affected versions of 'the-search' will cause visitor cookies to be sent to an attacker-controlled endpoint, potentially exposing sensitive session information and enabling session hijacking or unauthorized access. This compromises user privacy and application security.

Defensive guidance

Users should immediately remove or avoid using 'the-search' versions 1.0.0 and 1.0.1. Review dependencies for this package and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm advisory for any forthcoming fixes. Since this is a malicious package, do not attempt to use it in production environments.

Summary

The 'the-search' npm package (versions 1.0.0 and 1.0.1) includes a self-invoking browser payload that reads the document.cookie value from users visiting a web application that bundles this module. It base64-encodes the cookie data and submits it via a hidden form POST request to a hardcoded webhook.site URL controlled by an attacker. This malicious behavior is embedded directly in the package's main entry point, indicating the package is designed to steal user session cookies. The base64 encoding is a minor evasion technique to obscure the exfiltrated data in network traffic logs.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:38 UTC

Technical details

References

Community reviews