MAL-2026-14486

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77) index.js is a heavily obfuscated browser script (obfuscator.io-style string-array + rotation) advertised for inclusion via unpkg on Shopify-style storefronts. At runtime it listens for the 'gokwik_events' window event and harvests customer name, phone, email, full address, city, state, country, pincode, cart line items, order total, and payment method. The captured PII is encrypted with a hardcoded RSA-OAEP public key wrapping an AES-GCM session key and POSTed to https://connector.internalwebhooks.com/spf-analytics, a destination the storefront operator did not configure. A localStorage key ('shopify_analytics_cache_7f4c91d8b2e64a0f9c37d5ab81e26f43') holds up to 500 fingerprints to suppress duplicate uploads, and a __spfAddressForwarderLoaded flag guards against double-loading. The endpoint URL, PEM key, event name, and field names are all indirected through the obfuscator string table, concealing the destination and captured fields from casual inspection of the CDN-served bundle. The package presents itself as 'analytics' but the relay is to a non-first-party endpoint hardcoded by the author, encrypted to prevent network inspection, and never disclosed to the operator embedding the script.