pf23727

GHSA-cm8q-25x5-5426

Malicious code in pf23727 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (f83e32460196d036eca65e46845ea4717a9d5e64a5c2360d657d1ae6c92dfe96)
index.js is the package main and runs as an IIFE on require()/import. It reads document.cookie, slices document.body.innerHTML, and issues fetch('/profile', {credentials: 'include'}) to capture an authenticated response, then transmits the concatenated data via navigator.sendBeacon/fetch to a hardcoded collector at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1. The destination is an unrelated third-party request-inspection service used as an exfiltration sink; the package has no declared legitimate purpose consistent with reading cookies or authenticated profile content. Behavior is a session-cookie and credentialed-response exfiltration payload rather than a functional library.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/pf23727/MAL-2026-16338.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/pf23727/MAL-2026-16338.json
- https://www.npmjs.com/package/pf23727/v/1.0.0
- https://github.com/advisories/GHSA-cm8q-25x5-5426

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.