your-unique-package-name1@1.0.0

Analysis

The package injects a hidden iframe pointing to www[.]pendo[.]io/?builder.frameEditing=true and uses postMessage to inject JavaScript into the iframe's context. The injected payload fetches novus-api[.]pendo[.]io/pendo/app with the victim's Pendo session credentials, base64-encodes the API response, and exfiltrates it in 2000-byte chunks to webhook[.]site/ea1a1f2d-46e2-463a-a1c1-48c53846dff4 via Image beacon requests. This enables theft of Pendo application data and customer content from any browser that loads the package.