homestack-cheer@1.1.9

Summary

The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world 'greet' library. The ESM entrypoint declared in package.json 'module' (src/index.js) and src/env_load.js each end with new Function(atob('<~180KB base64>')).call(this), decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users' browsers. The decoded payload checks window.location for the substring 'checkout' and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id __privateStripeFrame84331 to intercept card input. The divergence between the benign main (UMD greet) and the malicious module (ESM Function(atob(...))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package's headline file.

Source: amazon-inspector (f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142)