Rendering the exported React component initiates an outbound request and attempts cookie exfiltration. This is concrete runtime credential theft behavior.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders FontAwesomeIcon.
Impact
Browser cookies available to the embedding page may be sent to an attacker-controlled endpoint.
Mechanism
Axios-based cookie exfiltration to hard-coded external hosts.
Attack narrative
On each render, index.jsx requests command.control and, if successful, posts document.cookie to commad.control/404. The network activity and cookie collection are not required for the advertised icon component and are hidden behind a benign render path.
Rationale
Direct source inspection confirms runtime cookie exfiltration to hard-coded external endpoints. The absence of lifecycle hooks does not mitigate this malicious browser-side behavior.
Network endpoints2
command.controlcommad.control/404