GCVE-110-OSM-2026-12504

On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL https://webhook.site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/, appending document.cookie as a query-string parameter. The package has no other advertised functionality; the sole effect of loading it is to send the ambient cookie value to a third-party webhook capture endpoint controlled by whoever provisioned that webhook.site token. webhook.site is a generic ad-hoc data-collection service, unrelated to any legitimate publisher infrastructure. ENTRY index.js (main: index.js) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in index.js: "webhook.site" - Data Encoding for Exfiltration in index.js: "encodeURIComponent(document.cookie" - Network Request in index.js: "fetch('https:" ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES index.js