add-colors-to-website@1.0.2

No blocking static signals were detected.

Loading or importing index.js in a browser page/frame.

Can force logout/navigation to an arbitrary URL-derived host and disrupt the embedding page.

Injected parent-frame redirect and oversized-query navigation.

At import time, index.js appends a script into the parent document. That script derives a host from the parent URL, redirects the current page to its logout route, and navigates window[0] to a URL containing an intentionally oversized query string.

The package has no legitimate color-related behavior; its sole runtime payload performs covert parent-frame navigation and disruption. This is concrete malicious browser behavior, not a scanner-only inference.