🛡️ MAL-2026-12810 — the-search

Malicious code in the-search (npm)

Source: amazon-inspector

The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-created hidden form POST to a hardcoded webhook.site endpoint (https://webhook.site/86b505ff-4280-459f-9b36-e765825c0ada). The package has no legitimate declared purpose consistent with this behavior; bundling this module into a web application causes visitor cookies to be sent to an attacker-controlled destination. The base64 wrapping around the JSON body is minor evasion to obscure the exfiltrated content in network logs.