Loading npm security reports…
Skip to main contentRemote Code Execution2026-07-10 08:39Remote Code Execution2026-07-10 08:37Remote Code Execution2026-07-10 08:36
npm threat feed
npm remote execution reports, with evidence.
Investigate remote code execution and remote payload execution, including code fetched or launched by a package. These reports have OSV or public advisory evidence. Each report identifies the package version, supporting evidence, advisory sources, and current Firewall decision.
Security reports — page 31
Updated 9 Oct 2026, 06:26 UTC. Ordered by latest scan.
cookie-parser-js@1.4.8
Direct inspection confirms an obfuscated remote fetch plus eval in index.js:41 on the package's main runtime path. This is concrete malicious behavior, not a package-aligned cookie parsin...
cookie-parser-js@1.4.9
Read-only source inspection confirms a runtime remote fetch plus eval chain in the package's main code path, using an obscured endpoint unrelated to cookie parsing. Absence of install hoo...
cookie-parser-js@1.5.1
Source inspection confirms a concrete runtime malicious chain: an obscured remote endpoint controls code passed to eval inside the package's primary exported function. Absence of install...
cookie-parser-js@1.5.0
Source inspection confirms a hidden network fetch and eval in index.js, unrelated to cookie parsing and activated during normal runtime use. This is concrete malicious remote code executi...