registry / react-fontawesome-icons / 1.0.5

react-fontawesome-icons@1.0.5

Font Awesome React component using SVG with JS

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Rendering the exported icon component triggers a network probe and posts the current page's cookies to a package-controlled endpoint.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A React application renders FontAwesomeIcon.

Impact

Session cookies may be disclosed to an external receiver, enabling account/session compromise.

Mechanism

Browser cookie exfiltration via axios POST

Attack narrative

The package's sole exported React component executes axios.get("http://command.control") during render. On success it posts an object containing document.cookie to http://commad.control/404. This is unconsented credential/session-token exfiltration activated by normal component use, with misleading comments and identifiers intended to conceal it.

Rationale

Direct source inspection confirms runtime cookie exfiltration to external endpoints; no install hook is required for the malicious behavior.

Evidence

index.jsxpackage.json

Network endpoints2

command.controlcommad.control/404

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

react-fontawesome-icons@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code