Poisoned Pipeline / Incidents / AS136

AS136 · 2025-09

Express cookie-parser impersonation on npm

npm

SafeDep Cloud scanning found a malicious npm package impersonating
the popular Express cookie-parser.

Mapped techniques

• T0129 Typosquatting
• T0109 Publish malicious artifact

supply-chain campaign

Sources

• https://safedep.io/malicious-npm-package-express-cookie-parser