set-cookie-ease@1.1.5

Analysis

Package "set-cookie-ease" is a trojanized clone of the legitimate js-cookie library. The CJS build (dist/cookie.ease.js) contains an injected remote code execution payload in the Cookies.set() function. When called in a Node.js environment (where document is undefined), it base64-decodes a URL pointing to jsonkeeper[.]com, fetches the content from that URL using the axios dependency, and executes it via eval() — enabling arbitrary code execution controlled by the remote server. The ESM and minified builds are clean, so the payload only triggers when using Node.js require().