malicious-npm-packages-cookie-parser-legacy-moustick.md

gistfile1.txt

## Malicious packages: cookie-parser-legacy and moustick

### Attack chain
1. package.json includes `cookie-parser-legacy: "latest"`
2. `cookie-parser-legacy` depends on `moustick: "latest"`
3. `moustick/index.js` eval()s remote payloads on install:
   - https://www.jsonkeeper.com/b/MYUKZ
   - https://www.jsonkeeper.com/b/HY6M6

### Payload
The code at HY6M6 is heavily obfuscated JavaScript (base64 + RC4/XOR 
layers). Executes silently at npm install with no user interaction required.

### Impersonation
Both packages copy the real author names (TJ Holowaychuk, Douglas 
Christopher Wilson) and point to legitimate expressjs GitHub repos to 
appear trustworthy.

### Target
.env.example in the host repo requests RELAYER_PRIVATE_KEY and JWT_SECRET.
These are the intended exfiltration targets.

### Delivery method
Fake recruiter on LinkedIn posing as a Web3 talent acquisition specialist. 
Researches the target's public GitHub in advance to ask credible technical 
questions, then delivers the malicious repo as a "20-30 minute assessment 
task." When the target identified the malware and called it out directly 
in chat, the attacker went silent then resumed the conversation pretending 
nothing had happened, still requesting a Loom screen recording.

### Recruiter profile (LinkedIn)
Name: Stanislav Svitlychnyi
Title: Full stack developer | Technical Talent Acquisition Specialist

### Affected packages
- cookie-parser-legacy: https://www.npmjs.com/package/cookie-parser-legacy
- moustick: https://www.npmjs.com/package/moustick

### Host repository
https://github.com/Oleksandr222-crypto/demo_project