Malicious code in merchantweb-lang-cookie-reset (npm)
The npm package merchantweb-lang-cookie-reset contained malicious code that resolved a dependency to a third-party host (artifacts.yosiroute.com) with install scripts enabled, allowing arbitrary code execution on npm install. The package was a stub designed solely to pull and execute code from the attacker-controlled host.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed merchantweb-lang-cookie-reset via npm
- Ecosystems
- Attack vectors
- Affected entities
- merchantweb-lang-cookie-resetnpm package containing malicious dependency resolution
The npm package merchantweb-lang-cookie-reset was identified as malicious by Amazon Inspector and the OpenSSF malicious-packages project. The package's package.json and npm-shrinkwrap.json files resolved a dependency named packet-table-thread-stream to a non-npm-registry URL: https://artifacts.yosiroute.com/npm/packet-table-thread-stream.\n\nThe dependency was configured with hasInstallScript: true, meaning npm would automatically download and execute lifecycle scripts from the attacker-controlled host during installation. There was no version pinning or integrity hash verification for the third-party URL, allowing the attacker to serve arbitrary code.\n\nThe merchantweb-lang-cookie-reset package itself was a stub with minimal functionality—its index.js only re-exported package name and version metadata. The sole purpose of installing the package was to trigger the download and execution of code from artifacts.yosiroute.com on the installer's machine.\n\nThe incident was identified and reported through the OpenSSF's malicious-packages repository (MAL-2026-13449).
Indicators of compromise
- Packages
- merchantweb-lang-cookie-reset
- Domains
- artifacts.yosiroute.com
Remediation
- Remove merchantweb-lang-cookie-reset from all package.json files and lock files
- Run npm audit to identify any other compromised dependencies
- Review npm install logs and audit trails for any suspicious activity during the period the package was installed
- If the package was installed, assume the system may be compromised and conduct a security investigation
- Update to a clean npm cache and reinstall dependencies from trusted sources only
- Monitor for any unexpected network connections or process execution that may have resulted from the malicious install scripts
Sources
- GitHub Advisory GHSA-5vjj-p6vh-456m · GitHub Advisory Database
Cite this entry
"Malicious code in merchantweb-lang-cookie-reset (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-merchantweb-lang-cookie-reset-npm-1wo1bi
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - activecritical
Malware in @sdgdfgdfhhhfd/multiviewr
Malware discovered in the npm package @sdgdfgdfhhhfd/multiviewr. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package