MAL-2026-14266

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electron-sessions/MAL-2026-14266.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14266
Published
2026-08-19T06:17:26Z
Modified
2026-08-19T07:00:14.282012044Z
Summary
Malicious code in electron-sessions (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769)

Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js (javascript-obfuscator with rotating string-array of length 4399, control-flow flattening, self-defending wrapper, dead-code injection) as both main and bin. The bundle contains plaintext substrings chrome, cookies, electron alongside an import of the @vercel/blob upload SDK (declared runtime dependency @vercel/blob: ^2.6.1), whose primary API uploads arbitrary bytes to a Vercel Blob store held by whoever controls the BLOB_READ_WRITE_TOKEN. Package naming targets Electron/Chromium session artifacts (cookies, Local Storage/leveldb, Login Data), the README exposes only a one-line new Sessions() cover-story API with no documented upload endpoint or caller-configurable destination, and the upload SDK has no legitimate purpose in a generic session-utilities library. Any process that runs npx electron-sessions or require('electron-sessions') executes the obfuscated bundle against its own host, and collected session data is shipped to an author-controlled Vercel Blob endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T06:49:44.1620261Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T06:17:26Z",
            "sha256": "cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769",
            "id": "IN-MAL-2026-018378",
            "versions": [
                "0.1.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / electron-sessions

Package

Name
electron-sessions
View open source insights on deps.dev
Purl
pkg:npm/electron-sessions

Affected ranges

Affected versions

0.*
0.1.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-xLsCjiIZzU9/Xnkn1y919Fg3Z1MciGzZSV/zLOwLB3wNvN4Vgn21WXVUx0i8H/1iSefP4nKMd3BxkQDUqrs1QQ==",
                "sha1": "5b54d60a8ae82962f02cfc795ff57cc8028adac7"
            },
            "filename": "electron-sessions-0.1.5.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "83ff80d3489158b7200b4de2ef765ee8e865a453f3f378b4d53d8643248438f5",
            "tlsh": "8d45536063c0ac53200f0fa3bf19fae5ed2d6e79b45119cbd560be58a6b9807c5e09f1"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/electron-sessions/MAL-2026-14266.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]