pf25262

GHSA-w55g-75g8-c4wj

Malicious code in pf25262 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb)
index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA{...} token or falls back to capturing document.cookie plus the response length, and redirects the browser to a hardcoded collector URL at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1/ with the captured data appended to the path. The package's entire shipped payload is this authenticated-session-data exfiltration snippet, sending same-origin credentials and cookies to an attacker-controlled webhook.site bin.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/pf25262/MAL-2026-16340.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/pf25262/MAL-2026-16340.json
- https://www.npmjs.com/package/pf25262/v/1.0.0
- https://github.com/advisories/GHSA-w55g-75g8-c4wj

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.