The react-fontawesome-icons package version 1.0.1, 1.0.2, 1.0.4, and 1.0.6 contains malicious code that exfiltrates user browser session cookies to a hardcoded external server. The component makes unauthorized network requests on every render, sending sensitive cookie data to an unresolvable and non-legitimate domain. This behavior is deliberate, as indicated by misleading comments and obfuscated code within the package. Any application using this package risks full compromise of the host system.