MAL-2026-14266 Malicious code in electron-sessions (npm)

Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js (javascript-obfuscator with rotating string-array of length 4399, control-flow flattening, self-defending wrapper, dead-code injection) as both main and bin. The bundle contains plaintext substrings chrome, cookies, electron alongside an import of the @vercel/blob upload SDK (declared runtime dependency @vercel/blob: ^2.6.1), whose primary API uploads arbitrary bytes to a Vercel Blob store held by whoever controls the BLOB_READ_WRITE_TOKEN. Package naming targets Electron/Chromium session artifacts (cookies, Local Storage/leveldb, Login Data), the README exposes only a one-line new Sessions() cover-story API with no documented upload endpoint or caller-configurable destination, and the upload SDK has no legitimate purpose in a generic session-utilities library. Any process that runs npx electron-sessions or require('electron-sessions') executes the obfuscated bundle against its own host, and collected session data is shipped to an author-controlled Vercel Blob endpoint.