Rendering the exported component initiates a remote request and conditionally exfiltrates browser cookies. This is unrelated to the declared icon component purpose.
Static reason
No blocking static signals were detected.
Trigger
Application runtime: invocation/render of the default-exported Icon component.
Impact
Session cookies from the embedding application's document can be sent to an attacker-controlled endpoint.
Mechanism
Browser cookie exfiltration via axios GET followed by POST.
Attack narrative
On every invocation of the exported component, index.js calls http://command.control. If that request succeeds, it POSTs a dummy metadata object plus document.cookie to http://commad.control/404. The trigger is ordinary application rendering, so affected sites can disclose browser session data without user consent.
Rationale
Direct source inspection confirms concrete runtime cookie exfiltration under the guise of an icon component. The absence of install hooks does not mitigate this application-runtime attack.
Network endpoints2
command.controlcommad.control/404