checking-session-security

The supplied code describes legitimate security findings, not malicious package behavior. The login fragment has a plausible session-fixation vulnerability because it authenticates an existing session without regenerating its identifier. The reported missing httpOnly flag is a valid session-cookie hardening concern if confirmed in the omitted configuration. No evidence of malware or intentional supply-chain sabotage is present.