Critical Malicious Code Vulnerability in redis-cookie-js Package
Summary
MAL-2026-66: Malicious code in redis-cookie-js (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The redis-cookie-js package is a JavaScript library available on npm that is designed to manage cookies in applications that utilize Redis for session storage. It is commonly used in web applications to enhance user experience by managing user sessions and preferences. However, this package has been compromised, leading to severe security implications for any system utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code embedded within the redis-cookie-js package. This code can fully compromise any computer that has the package installed or running, allowing unauthorized access to sensitive information, including secrets and keys. The origin of this malicious code has been traced back to a malicious actor who injected it into the package, making it a significant threat to users and systems relying on this library.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall redis-cookie-jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the redis-cookie-js package altogether and consider alternative libraries for cookie management that do not have known vulnerabilities. Additionally, ensure that your application is monitored for any unusual activity that may indicate a breach.
Conclusion
The redis-cookie-js package has been identified as containing malicious code that poses a serious security risk. Immediate action is required to remove the package and secure any sensitive information. Users are encouraged to monitor their applications for vulnerabilities and consider alternative libraries for cookie management.
See every vulnerability recorded for redis-cookie-js →
FAQ
redis-cookie-js is a JavaScript library used for managing cookies in applications that utilize Redis for session storage.
The malicious code can compromise your system, allowing unauthorized access to sensitive information and potentially leading to data breaches.
You should remove the redis-cookie-js package immediately and rotate any secrets or keys stored on the affected system.
Yes, consider using other cookie management libraries that are known to be secure and do not have reported vulnerabilities.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just the package-lock.json file. You can also check your application for this specific vulnerability using the Vulert playground at Vulert Scanner.
