homestack-cheer@1.1.9

Analysis

homestack-cheer ships a Magecart-style payment-card skimmer in its module entry points (src/index.js, src/env_load.js), each executing an obfuscated payload via new Function(atob(...)). On a checkout page the payload hides the legitimate Stripe payment-element iframe, injects a fake #__privateStripeFrame84331 iframe impersonating Stripe's private payment frame, and re-enables the place-order button to capture card data entered by the victim. The package's built dist/my-lib.umd.js is a benign stub, and its README is copied from an unrelated package, so the skimmer is the only real content.