The react-fontawesome-icons package, advertised as a React FontAwesome SVG icon component, includes a default-exported Icon component that performs unconditional network I/O on every render cycle. Specifically, it makes an axios GET request to http://command.control followed by an axios POST to http://commad.control/404, sending document.cookie and other constructed data in the POST body. This results in leakage of users' session cookies over unencrypted HTTP to an attacker-controlled domain. The source code contains obfuscation techniques such as misleading comments and base64-encoded blobs to conceal the exfiltration behavior.

Applications that render the malicious Icon component leak their users' session cookies to an attacker-controlled external domain over plaintext HTTP. This exposure can lead to session hijacking or unauthorized access to user accounts. The exfiltration occurs silently and is hidden by obfuscation, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should immediately stop using the affected versions of react-fontawesome-icons (1.0.1, 1.0.2, 1.0.4, 1.0.6). Review and remove this package from projects and replace it with a trusted alternative. Monitor dependencies carefully for malicious behavior and verify package integrity before use. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.