Malicious Code Detected in kmf-cookieservice Package - Security Alert
Summary
MAL-2025-191498: Malicious code in kmf-cookieservice (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kmf-cookieservice package is an npm library designed to manage cookie services in web applications. It provides functionalities for setting, getting, and deleting cookies, making it a useful tool for developers working with client-side storage. However, recent findings have revealed that this package contains malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The kmf-cookieservice package has been identified to contain malicious code, which was discovered through an analysis by Amazon Inspector. This vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and exploitation of the affected systems. The malicious code may execute harmful actions without the user's consent, making it critical for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall kmf-cookieserviceIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider removing the kmf-cookieservice package from your project until a secure version is released. You can do this by executing the command: 'npm uninstall kmf-cookieservice'. This will help mitigate the risk of exposure to the malicious code.
Conclusion
The kmf-cookieservice package has been found to contain malicious code, posing serious security risks to applications that utilize it. Developers are urged to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for kmf-cookieservice →
FAQ
kmf-cookieservice is an npm package used for managing cookies in web applications, allowing developers to set, get, and delete cookies easily.
The malicious code was identified through an analysis conducted by Amazon Inspector, which scans packages for security vulnerabilities.
The risks include unauthorized access to sensitive data, potential data breaches, and exploitation of the affected systems, which can lead to severe consequences for users and developers.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert provides real-time alerts for any vulnerabilities. You can check your application using the Vulert playground at Vulert Scanner without needing to sign up.
If an immediate update is not possible, consider removing the kmf-cookieservice package from your project as a temporary measure to reduce exposure to the malicious code.
