Malicious Code Injection in pflag14570 Package - Session Cookie Theft
Summary
MAL-2026-16341: Malicious code in pflag14570 (npm). Affects pflag14570 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pflag14570 package is an npm module that, based on its metadata, lacks a legitimate documented function. It is designed to be used in a browser context, but it has been identified as containing malicious code that executes upon loading the module. This code is capable of reading session cookies and scraping sensitive application paths, posing a significant security risk to users.
Vulnerability Detail
The vulnerability originates from an embedded malicious code within the pflag14570 package. When the module is loaded, it executes an Immediately Invoked Function Expression (IIFE) that reads the document.cookie, fetches a list of authenticated application paths, extracts sensitive information, and sends this data to a hardcoded external collector. This poses a risk of session hijacking and unauthorized access to user accounts, making it critical for users of this package to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pflag14570If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of this malicious code by removing the pflag14570 package from your dependencies and replacing it with a secure alternative that provides similar functionality without the security risks.
Conclusion
The pflag14570 package poses a serious security threat due to its embedded malicious code that can steal session cookies and scrape sensitive information. Users are advised to remove this package and monitor their applications for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in real-time.
See every vulnerability recorded for pflag14570 →
FAQ
pflag14570 is an npm package that has been identified as containing malicious code designed to steal session cookies and scrape sensitive information from web applications.
The malicious code executes when the module is loaded, reading cookies and sending sensitive data to an external server controlled by attackers.
The risks include session hijacking, unauthorized access to user accounts, and potential data breaches, which can lead to significant security incidents.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have used the pflag14570 package, it is crucial to remove it from your project immediately and replace it with a secure alternative.
