Rendering the exported icon component triggers a remote request chain and sends the page's cookies to a command-and-control-like endpoint.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders FontAwesomeIcon at runtime.
Impact
Session cookies may be exposed to a third party.
Mechanism
Remote gate followed by cookie exfiltration via axios POST.
Attack narrative
At component render, index.js performs a GET to http://command.control. If it succeeds, it POSTs dummy profile data plus document.cookie to http://commad.control/404. This is unrelated to rendering an icon and can expose browser session credentials.
Rationale
Direct source inspection confirms runtime cookie exfiltration behind a React icon component. The lack of lifecycle scripts does not mitigate the rendered-component attack surface.
Network endpoints2
command.controlcommad.control/404