OpenSSF/OSV advisory MAL-2026-13449 confirms this npm version as malicious. package.json and npm-shrinkwrap.json resolve the sole dependency `packet-table-thread-stream` to `https://artifacts.yosiroute.com/npm/packet-table-thread-stream`, a non-npm-registry host unrelated to the declared publisher (github.com/example/merchantweb-lang-cookie-reset, author `Package Registry`, description `Generated package`)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in merchantweb-lang-cookie-reset (npm)
Details
package.json and npm-shrinkwrap.json resolve the sole dependency `packet-table-thread-stream` to `https://artifacts.yosiroute.com/npm/packet-table-thread-stream`, a non-npm-registry host unrelated to the declared publisher (github.com/example/merchantweb-lang-cookie-reset, author `Package Registry`, description `Generated package`). The dependency is marked `hasInstallScript: true`, so on `npm install` npm downloads a tarball from this third-party host and runs its lifecycle scripts on the installer's machine. There is no version pinning to a registry artifact and no integrity hash for the third-party URL; the bytes served are mutable and controlled by that host. The package itself is a stub whose index.js only re-exports name/version, so the sole effect of installing it is to pull and execute code from artifacts.yosiroute.com.
Decision reason
OpenSSF Malicious Packages via OSV confirms merchantweb-lang-cookie-reset@99.99.99 as malicious (MAL-2026-13449): Malicious code in merchantweb-lang-cookie-reset (npm)