reading-cookies@6.13.2

Analysis

reading-cookies@6.13.2 is a second-stage RCE loader disguised as a pino-logger-like package. Its index.js exports a middleware function that spawns lib/caller.js as a detached background node subprocess (detached:true, stdio:ignore, child.unref()). caller.js contains a base64-obfuscated C2 URL pointing to api[.]jsonstorage[.]net/v1/json/... — it fetches the remote endpoint via axios, extracts .data.cookie from the response, and executes the downloaded content as arbitrary code via new Function.constructor("require", s), passing the real require so the payload can import any module. The package name "reading-cookies" is a decoy; the description is a copy-pasted vulnerability-management text unrelated to the code; the publisher uses a throwaway Outlook address; and the package bundles legitimate pino source files as camouflage while jumping directly to version 6.13.2 to appear established.