OpenSSF/OSV advisory MAL-2026-3669 confirms this npm version as malicious. The main entry g.js constructs an image beacon whose src is a base64-decoded attacker URL (https://w.g32.com/g?k=) concatenated with btoa(document.location.href + '*' + document.cookie), exfiltrating the current URL and cookies cross-origin. The destination host is deliberately hidden behind atob() to evade string-based scanning...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 100jsss (npm)
Details
The main entry g.js constructs an image beacon whose src is a base64-decoded attacker URL (https://w.g32.com/g?k=) concatenated with btoa(document.location.href + '*' + document.cookie), exfiltrating the current URL and cookies cross-origin. The destination host is deliberately hidden behind atob() to evade string-based scanning. The package has placeholder metadata, no real functionality, and a trivial README, consistent with a malicious PoC/throwaway upload rather than a legitimate library. Obfuscation + exfiltration + credential-theft target (document.cookie) is an unambiguous malicious combination.
Decision reason
OSV/OpenSSF confirms 100jsss@1.0.0 as malicious package MAL-2026-3669. Malicious code in 100jsss (npm)