Malicious Code Detected in Cookie-Breaker Package - npm Vulnerability
Summary
MAL-2025-192727: Malicious code in cookie-breaker (npm). Affects cookie-breaker versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'cookie-breaker' package is a utility designed for managing and manipulating cookies in JavaScript applications. It is commonly used in web development to simplify cookie handling, providing developers with an easy-to-use interface. However, recent findings have revealed that version 1.1.0 of this package contains malicious code, posing a significant security risk to applications that rely on it.
Vulnerability Detail
The vulnerability in the 'cookie-breaker' package stems from the introduction of malicious code that can compromise the integrity of applications using this package. This code may allow unauthorized access to sensitive data, potentially leading to data breaches or exploitation of user information. The origin of this vulnerability is linked to a malicious actor who has injected harmful code into the package, which was subsequently published to the npm registry. Users of this package are at risk of having their applications manipulated or their data exposed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cookie-breakerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can avoid using the 'cookie-breaker' package until a secure version is released. Consider implementing cookie management manually or using alternative libraries that are known to be secure.
Conclusion
The discovery of malicious code in the 'cookie-breaker' package highlights the importance of vigilance when using open-source software. Developers should take immediate action to secure their applications by removing or replacing the affected package and utilizing tools like Vulert to monitor for future vulnerabilities.
See every vulnerability recorded for cookie-breaker →
FAQ
The 'cookie-breaker' package is a JavaScript utility for managing cookies in web applications, simplifying cookie handling for developers.
The malicious code can compromise your application's security, potentially leading to unauthorized access to sensitive data and user information.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you are using version 1.1.0 of 'cookie-breaker', it is recommended to remove the package or replace it with a secure alternative until a patched version is available.
Utilizing tools like Vulert can help you monitor your dependencies for vulnerabilities in real-time, ensuring you are alerted to any issues as they arise.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
