The 'gmail-changer' npm package (version 2.0.2) exports a complete Gmail account hijacking pipeline driven by stolen session cookies. It automates removing the victim's recovery phone number, injecting an attacker-controlled recovery email at @oletters.com, resetting the password, signing out other devices, harvesting two-factor authentication seeds and backup codes, and changing the display name. OTP interception is performed via a hardcoded SMS rental endpoint (sever1.tempxapi.com/api/sms) using an integrity token to facilitate recovery-number swaps and login challenges. The package also enumerates the victim's mailbox via Gmail's undocumented sync RPC for post-takeover reconnaissance. Puppeteer is used with stealth plugins and request interception to silently harvest session cookies without completing page transitions. All exported APIs are malicious, serving attacker interests with no legitimate functionality.

This package enables attackers to fully compromise Gmail accounts by automating recovery option manipulation, password resets, device sign-outs, and 2FA secret harvesting. It also allows attackers to intercept OTPs via a third-party SMS rental service and perform mailbox reconnaissance. Installation or use of this package directly facilitates unauthorized account takeovers and persistent access to victim Gmail accounts.

This is a malicious package with no legitimate use. Users and organizations should avoid installing or using 'gmail-changer' version 2.0.2. Remove the package if already installed. Monitor for any unauthorized account changes if this package was used. There is no official patch or fix since this is a malicious tool rather than a vulnerability in legitimate software. Use trusted sources and verify package integrity before installation.