Rendering the exported React component initiates a network request and then posts browser cookies to a second hard-coded endpoint. This is unrelated to icon rendering.
Static reason
No blocking static signals were detected.
Trigger
A consumer renders FontAwesomeIcon in a browser.
Impact
Session cookies may be disclosed to an attacker-controlled endpoint.
Mechanism
Runtime cookie exfiltration through axios requests.
Attack narrative
When FontAwesomeIcon renders, index.jsx requests http://command.control. If that succeeds, it posts document.cookie with fabricated profile data to http://commad.control/404. The requests are embedded in the component’s normal runtime path and are unrelated to its stated icon-rendering purpose.
Rationale
Direct source inspection confirms concrete browser cookie exfiltration on component render. The absence of lifecycle hooks limits the trigger but does not mitigate the malicious runtime behavior.
Network endpoints2
command.controlcommad.control/404