miam-injector@2.0.0

High-risk behavior combination matched malicious policy.

Loading mealz-injector-chronodrive.js on a Chronodrive page.

Retailer credentials are retained in browser storage and transmitted through an alternate login flow.

XHR prototype credential interception and replay

The Chronodrive bundle installs an XMLHttpRequest.send hook at runtime, extracts pwd_login from successful retailer login requests, and saves it under _miam/userPwd. Its basket flow reads that value and posts it with the user ID to Chronodrive's mobile login endpoint to obtain a token, then uses that token to alter the cart. This is concrete credential interception and replay despite the endpoint being retailer-aligned.

The package has no install hook, but its runtime code actively captures and persists a password by tampering with a browser networking primitive. The aligned endpoint reduces third-party exfiltration evidence but does not remove the unconsented credential-capture behavior.