MAL-2026-12810
Malicious code in the-search (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd) The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-created hidden form POST to a hardcoded webhook.site endpoint (https://webhook.site/86b505ff-4280-459f-9b36-e765825c0ada). The package has no legitimate declared purpose consistent with this behavior; bundling this module into a web application causes visitor cookies to be sent to an attacker-controlled destination. The base64 wrapping around the JSON body is minor evasion to obscure the exfiltrated content in network logs.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for the-search (npm). Pin to a known-safe version or switch to an alternative.