file-public-cdn-hn@1.1.17599-1758001725447

Analysis

This package contains a browser-cookie stealer. One of its bundled scripts enumerates every cookie from all domains using the browser cookies API, concatenates them into a single text dump grouped by domain, and uploads that dump as a timestamped .txt file to a remote server (ninja2t[.]top/upload.php). After a successful upload it sends the URL of the stolen-cookie file to an attacker-controlled Telegram bot via the Telegram sendMessage API. The package main entry point is a harmless Hello World decoy, and the name/keywords masquerade as a CDN helper utility. Installing or loading this code exposes all of a victim browser session cookies, enabling session hijacking and account takeover.