OpenSSF/OSV advisory MAL-2026-12810 confirms this npm version as malicious. The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-created hidden form POST to a hardcoded webhook.site endpoint (https://webhook.site/86b505ff-4280-459f-9b36-e765825c0ada)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in the-search (npm)
Details
The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-created hidden form POST to a hardcoded webhook.site endpoint (https://webhook.site/86b505ff-4280-459f-9b36-e765825c0ada). The package has no legitimate declared purpose consistent with this behavior; bundling this module into a web application causes visitor cookies to be sent to an attacker-controlled destination. The base64 wrapping around the JSON body is minor evasion to obscure the exfiltrated content in network logs.
Decision reason
OpenSSF Malicious Packages via OSV confirms the-search@1.0.0 as malicious (MAL-2026-12810): Malicious code in the-search (npm)