Skip to content
Heist/ feed
Unrated

Malicious code in merchantweb-lang-cookie-reset (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be) package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https://artifacts.yosiroute.com/npm/packet-table-thread-stream`), with no version pin and no integrity hash. The shrinkwrap marks that dependency `hasInstallScript: true`, so on `npm install` npm fetches opaque code from `artifacts.yosiroute.com` and executes its lifecycle scripts on the installer's machine, bypassing npm registry scanning. The wrapper package itself is a disposable shim: index.js is trivial (only re-exports name/version), and package.json metadata is placeholder (`author: Package Registry`, `description: Generated package`, `repo: github.com/example/...`). The package's only functional effect on install is pulling attacker-controlled code from a non-registry host into the installer's dependency tree and running its install scripts.

Announced Source revision 1
Original source ↗

MAL-2026-13449

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-13449

merchantweb-lang-cookie-reset

Source reference: /affected/0/package/name

Affected versions
99.99.99

Source reference: /affected/0/versions

1.0.998

Source reference: /affected/0/versions

2.0.0

Source reference: /affected/0/versions

0.1.999

Source reference: /affected/0/versions

0.999.999

Source reference: /affected/0/versions

0.1.0

Source reference: /affected/0/versions

1.999.999

Source reference: /affected/0/versions

1.0.999

Source reference: /affected/0/versions

0.0.999

Source reference: /affected/0/versions

0.0.6

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "package": {
      "name": "merchantweb-lang-cookie-reset",
      "purl": "pkg:npm/merchantweb-lang-cookie-reset",
      "ecosystem": "npm"
    },
    "versions": [
      "99.99.99",
      "1.0.998",
      "2.0.0",
      "0.1.999",
      "0.999.999",
      "0.1.0",
      "1.999.999",
      "1.0.999",
      "0.0.999",
      "0.0.6"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/merchantweb-lang-cookie-reset/MAL-2026-13449.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "npm-shrinkwrap.json",
            "tlsh": "1df04669c16a79f352d2a6e885758943a963c00f510c685dbb9cc019cf0e5ab34b5a08",
            "sha256": "08861f89f25f8a326cadf906823bb7a2a5c6c1b8cb619704c56dfa69e740d4a9"
          },
          {
            "path": "package.json",
            "tlsh": "ebf02038c618a6b34ad509d89c655843aa278d1fe208b8999bd2c13a870e09728be91d",
            "sha256": "1f24d7f512fba7b853e6ed55acb38035b7201621295739331daae1ef7f5653e0"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "ec87e43dfa088eb04e0e7390f0133169f71adf5d",
              "sha512_sri": "sha512-wB/2nNHxpKGl8UauABjQIxwQE/+IQs4Wy8epQ5dkazZidVQDthoW5fJSavfeg4iWEQ85LFLBJETUWfQy9aT7RQ=="
            },
            "filename": "merchantweb-lang-cookie-reset-99.99.99.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#10960 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement