MAL-2026-14266
Malicious code in electron-sessions (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769) Package published as `electron-sessions` advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated `dist/index.js` (javascript-obfuscator with rotating string-array of length 4399, control-flow flattening, self-defending wrapper, dead-code injection) as both `main` and `bin`. The bundle contains plaintext substrings `chrome`, `cookies`, `electron` alongside an import of the `@vercel/blob` upload SDK (declared runtime dependency `@vercel/blob: ^2.6.1`), whose primary API uploads arbitrary bytes to a Vercel Blob store held by whoever controls the `BLOB_READ_WRITE_TOKEN`. Package naming targets Electron/Chromium session artifacts (cookies, Local Storage/leveldb, Login Data), the README exposes only a one-line `new Sessions()` cover-story API with no documented upload endpoint or caller-configurable destination, and the upload SDK has no legitimate purpose in a generic session-utilities library. Any process that runs `npx electron-sessions` or `require('electron-sessions')` executes the obfuscated bundle against its own host, and collected session data is shipped to an author-controlled Vercel Blob endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for electron-sessions (npm). Pin to a known-safe version or switch to an alternative.