GCVE-110-OSM-2026-12686

This package contains top-level code in its main module that unconditionally POSTs document.cookie to the hardcoded remote endpoint https://c-b34596407b6d47d6.dgactf-challs.site/addPost via a sendPost(...) call. Any downstream web application that bundles this package will, when loaded in a user's browser, transmit that user's cookies and session data to the external host. The destination is not a first-party service and is not caller-configurable; the exfiltration runs as a side effect of loading the module. The package's declared functionality does not require reading or transmitting cookies, and no consent gate or configuration controls the behavior. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account