100jsss

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (207a07d918d9b3ddfdf0f845ec22f6bab19629fa77968d3b41409d0b62bad441)
The main entry g.js constructs an image beacon whose src is a base64-decoded attacker URL (https://w.g32.com/g?k=) concatenated with btoa(document.location.href + '*' + document.cookie), exfiltrating the current URL and cookies cross-origin. The destination host is deliberately hidden behind atob() to evade string-based scanning. The package has placeholder metadata, no real functionality, and a trivial README, consistent with a malicious PoC/throwaway upload rather than a legitimate library. Obfuscation + exfiltration + credential-theft target (document.cookie) is an unambiguous malicious combination.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.