MAL-2026-13449

Dashboard / Malicious Package / MAL-2026-13449

MAL-2026-13449

Summary: Malicious code in merchantweb-lang-cookie-reset (npm)

Details: Source: amazon-inspector (fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be) package.json declares the sole dependency `packet-table-thread-stream` as a direct tarball URL to a non-npm host (`https://artifacts.yosiroute.com/npm/packet-table-thread-stream`), with no version pin and no integrity hash. The shrinkwrap marks that dependency `hasInstallScript: true`, so on `npm install` npm fetches opaque code from `artifacts.yosiroute.com` and executes its lifecycle scripts on the installer's machine, bypassing npm registry scanning. The wrapper package itself is a disposable shim: index.js is trivial (only re-exports name/version), and package.json metadata is placeholder (`author: Package Registry`, `description: Generated package`, `repo: github.com/example/...`). The package's only functional effect on install is pulling attacker-controlled code from a non-registry host into the installer's dependency tree and running its install scripts.

References: https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/99.99.99, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/1.0.998, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/2.0.0, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/0.1.999, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/0.999.999, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/0.1.0, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/1.999.999, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/1.0.999, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/0.0.999, https://www.npmjs.com/package/merchantweb-lang-cookie-reset/v/0.0.6