GCVE-110-OSM-2026-6722

Malicious package detected. Behaviors: data exfiltration. ENTRY dist/cookie.ease.mjs (main: dist/cookie.ease.mjs) DESTINATION - custom-c2: https://www.jsonkeeper.com/b/VKUNI (primary, decoded) in dist/cookie.ease.js - custom-c2: www.jsonkeeper.com (decoded) in dist/cookie.ease.js EXFIL - Data Encoding for Exfiltration in dist/cookie.ease.js: "encodeURIComponent(value).replace" - Data Encoding for Exfiltration in dist/cookie.ease.mjs: "encodeURIComponent(value).replace" OBFUSCATION - Decoded Base64 Content in dist/cookie.ease.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES dist/cookie.ease.js INDICATORS (IOCs) - urls: https://codeclimate.com/github/set-cookie-ease/set-cookie-ease, https://data.jsdelivr.com/v1/package/npm/set-cookie-ease/badge?style=rounded, https://www.jsdelivr.com/package/npm/set-cookie-ease, https://www.browserstack.com/automate/public-build/b3VDaHAxVDg0NDdCRmtUOWg0SlQzK2NsRVhWTjlDQS9qdGJoak1GMzJiVT0tLVhwZHNvdGRoY284YVRrRnI3eU1JTnc9PQ==--5e88ffb3ca116001d7ef2cfb97a4128ac31174c2, http://blogs.msdn.com/b/ieinternals/archive/2009/08/20/wininet-ie-cookie-internals-faq.aspx (+1 more) - domains: cloud.githubusercontent.com, codeclimate.com, data.jsdelivr.com, www.jsdelivr.com, www.browserstack.com (+3 more) - emails: set-cookie-ease@googlegroups.com - payloadFileHash: 540960191cc1f421c1c9fa10e2d77034785ecfc0b5b86fae9355a919fcb26d01