cookie-sign@2.3.5

Analysis

cookie-sign@2.3.5 is a typosquat of the legitimate cookie-signature package. On install, index.js spawns a detached background Node.js process that runs lib/initializeCaller.js. This file base64-decodes a hardcoded C2 endpoint (hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df), POSTs all environment variables (process.env) to that endpoint — exfiltrating any API keys, tokens, or secrets present in the installer's environment — then executes the C2 response as arbitrary JavaScript code via the Function constructor, giving the attacker full remote code execution on the victim's machine.