GCVE-110-OSM-2026-12416

The package's main entry executes a top-level side effect that reads document.cookie and sends it via fetch to a hardcoded webhook.site collector URL (http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa) over plain HTTP. Any environment that imports or requires this package leaks its browser cookies to an anonymous third-party listener controlled by the package author. The destination is a webhook.site inbox — an anonymous request-capture service unrelated to any legitimate feed-widget functionality — and the transmission fires unconditionally on load, with no caller opt-in or configuration. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({...localStorage}); fetch('/addPost', { method: 'POS" - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES index.js