pf25262@1.0.0

Analysis

The package ships a single browser-side script (index.js) that fetches /profile with credentials included, extracts a DGA{...} token from the response or falls back to the browser's document.cookie plus page length, then redirects the browser to hxxps://webhook[.]site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1/ with the stolen data URL-encoded. This exfiltrates session cookies and profile tokens to an attacker-controlled webhook[.]site endpoint.