pf23727@1.0.0

Analysis

pf23727@1.0.0 ships a single index.js that acts as a browser-side data-theft implant. When loaded, it POSTs the page's document.cookie and the first 1500 characters of document.body.innerHTML to the attacker-controlled webhook[.]site endpoint hxxps://webhook[.]site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1 via sendBeacon/fetch. It then fetches '/profile' with credentials:'include' (capturing the authenticated session) and exfiltrates the response text to the same webhook. The package steals session cookies and authenticated page content and forwards them to the external interaction-service host.