xz-c-d@1.5.3

Analysis

A heavily obfuscated ES module that collects the browser's user-agent string (navigator.userAgent) and exfiltrates it as a base64-encoded JSON payload inside an X-Access HTTP header, POSTed to a remote C2 endpoint whose URL is obfuscated and decoded at runtime. The module first attempts to send the payload via navigator.sendBeacon() (stealthy exfiltration that persists after page unload), falling back to an axios HTTP POST. The package has no declared purpose (empty description, no repository) and is published from a throwaway identity.