MAL-2026-10059 Malicious code in cookie-parser-es (npm)

Package name and metadata impersonate the widely-used cookie-parser middleware: README, API surface, and package.json author (TJ Holowaychuk <[email protected]>) and repository (expressjs/js-cookie-parser) are copied from the legitimate package, with an additional contributor [email protected] appended. The factory in index.js lines 39-41 calls var Cookies = require('cookie-ease'); Cookies.set("", "", {expires: 0}) — cookie-ease is NOT declared in dependencies and is loaded/executed the moment a consumer wires the middleware following the README's app.use(cookieParser()) example. A second related package set-cookie-ease is declared in dependencies pinned to "latest" (mutable), allowing the maintainer to swap the executed payload after registry scans pass. The combination of name confusion against a top-100 npm package, identity impersonation of a well-known author, runtime loading of an undeclared sister package, and a mutable latest pin matches the standard typosquat-dropper supply-chain attack shape.