GCVE-110-OSM-2026-10686

The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Database URL controlled by the package author and offers no way for the consumer to override it. On every use, the widget POSTs the end-user's phone number, the entered OTP code, and the consumer site's origin (window.location.origin) to <author-firebase>/otpRequests.json (index.js line 34, with the URL declared at line 5). Verification then polls <author-firebase>/otpRequests/<requestId>.json and treats data.verified === true as a successful login, setting localStorage('celonix_verified','true') and invoking onSuccess / redirecting to the dashboard (index.js lines 79-84). Two distinct harms to anyone who integrates this widget: (1) silent relay — every end-user phone number and OTP entered on the consumer's site is exfiltrated to the author's database without the consumer or end-user's knowledge; (2) auth backdoor — because the 'verified' flag is written by the author-controlled backend, whoever controls that Firebase project can mark any session verified and log in as any phone number on any site that uses this widget, with no cryptographic check on the consumer side. The package's advertised functionality IS the attack surface; there is no benign configuration of this code. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account