pf25262

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb)
index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA{...} token or falls back to capturing document.cookie plus the response length, and redirects the browser to a hardcoded collector URL at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1/ with the captured data appended to the path. The package's entire shipped payload is this authenticated-session-data exfiltration snippet, sending same-origin credentials and cookies to an attacker-controlled webhook.site bin.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.