MAL-2026-16338

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f83e32460196d036eca65e46845ea4717a9d5e64a5c2360d657d1ae6c92dfe96) index.js is the package main and runs as an IIFE on require()/import. It reads document.cookie, slices document.body.innerHTML, and issues fetch('/profile', {credentials: 'include'}) to capture an authenticated response, then transmits the concatenated data via navigator.sendBeacon/fetch to a hardcoded collector at https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1. The destination is an unrelated third-party request-inspection service used as an exfiltration sink; the package has no declared legitimate purpose consistent with reading cookies or authenticated profile content. Behavior is a session-cookie and credentialed-response exfiltration payload rather than a functional library.