The monogrok npm package masquerades as a generic MIT-licensed library but contains a hidden spam, phishing, and mailbox-cracking toolkit. On loading its main entry point, it sends host information and a bearer token to a hardcoded attacker endpoint. It also accesses the installer's Chrome user data directory to extract live session cookies from Outlook and Gmail sessions via puppeteer automation. Additionally, it depends on an unpinned mutable branch of a third-party library, enabling arbitrary transitive code injection during installation. The entire codebase is obfuscated to evade detection. This malicious behavior effectively compromises host credentials, session cookies, and enables mail abuse operations.

Installation of affected monogrok versions results in exfiltration of sensitive host information and bearer tokens, theft of live browser session cookies including secure and httpOnly cookies, and deployment of mail abuse tools capable of SMTP credential brute forcing, mailbox checking, phishing redirects, proxy rotation, and bulk mailing. The use of a mutable third-party dependency further increases risk by allowing arbitrary code execution during installation. This compromises user credentials, privacy, and system integrity.

No official patch or remediation is currently available. Users should immediately uninstall affected versions (=1.0.30, =1.0.33) of monogrok and avoid installing this package. Audit systems for signs of compromise related to mail abuse and credential theft. Monitor for unauthorized network connections to the indicated attacker endpoint. Since this is a malicious package, rely on trusted sources and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.