The my-skibidi npm package versions 1.0.0 through 1.1.6 include top-level code in the main module that automatically posts the user's document.cookie to a fixed external URL (https://c-b34596407b6d47d6.dgactf-challs.site/addPost) via a sendPost call. This behavior is unconditional and not configurable by the user or application. The package's intended functionality does not require cookie access or transmission, indicating malicious intent. Any web application that bundles this package will leak session cookies to an attacker-controlled endpoint when loaded in a user's browser. The package should be considered fully compromised, and systems with it installed may be fully compromised as well.

Users of web applications that include the my-skibidi package risk having their session cookies and potentially sensitive session data exfiltrated to an attacker-controlled external server. This can lead to session hijacking and unauthorized access to user accounts. The compromise extends to any computer with the package installed or running, potentially allowing attackers full control over the system. Secrets and keys stored on affected systems should be considered compromised and rotated immediately.

Remove the my-skibidi package from all projects and systems immediately. Rotate all secrets, keys, and credentials that may have been exposed due to the compromise from a separate, trusted environment. Because the package may have allowed full system compromise, conduct a thorough security assessment and consider rebuilding affected systems. There is no indication of an official patch or fix; therefore, avoid using this package entirely.