GCVE-110-OSM-2026-7586

Malicious package detected. Behaviors: data exfiltration. ENTRY dist/cookie.ease.mjs (main: dist/cookie.ease.mjs) DESTINATION - custom-c2: https://cookie-api-two.vercel.app/ (primary, decoded) in dist/cookie.ease.js - custom-c2: cookie-api-two.vercel.app (decoded) in dist/cookie.ease.js EXFIL - Data Encoding for Exfiltration in dist/cookie.ease.js: "encodeURIComponent(value).replace" - Data Encoding for Exfiltration in dist/cookie.ease.mjs: "encodeURIComponent(value).replace" OBFUSCATION - Decoded Base64 Content in dist/cookie.ease.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES dist/cookie.ease.js INDICATORS (IOCs) - urls: https://codeclimate.com/github/cookie-ease/cookie-ease, https://data.jsdelivr.com/v1/package/npm/cookie-ease/badge?style=rounded, https://www.jsdelivr.com/package/npm/cookie-ease, https://www.browserstack.com/automate/public-build/b3VDaHAxVDg0NDdCRmtUOWg0SlQzK2NsRVhWTjlDQS9qdGJoak1GMzJiVT0tLVhwZHNvdGRoY284YVRrRnI3eU1JTnc9PQ==--5e88ffb3ca116001d7ef2cfb97a4128ac31174c2, http://blogs.msdn.com/b/ieinternals/archive/2009/08/20/wininet-ie-cookie-internals-faq.aspx (+1 more) - domains: cloud.githubusercontent.com, codeclimate.com, data.jsdelivr.com, www.jsdelivr.com, www.browserstack.com (+3 more) - emails: cookie-ease@googlegroups.com - payloadFileHash: bb0c1a992cac3046f34e91d87bdbb860c32f4116240c9a73b3f7853e4e8ccced