cookie-parser-js@1.4.8
Malicious code in cookie-parser-js (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
Combosquat of the real cookie-parser package. On require(), index.js makes an HTTPS GET to cookie-api-two[.]vercel[.]app and evals the response body as JavaScript, giving the remote server full code execution in the context of the importing application.
- analyzed by
- Leitwacht
- first seen
- Jul 9, 2026, 03:23 PM
- analyzed
- Jul 9, 2026, 03:24 PM
Related advisories
- express-router-engine@3.6.6
- type-slint@3.3.7
- chai-as-smart@2.3.5
- vite-pwa-config@1.1.1
- cookie-js-ease@2.1.7
- polymarket-kelly-stake-math@3.6.1
- polymarket-kit@2.4.1
- chai-as-const@1.4.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.