It strikes me that this is most likely to be used as part of an exfiltration mechanism for a malicious JS package or similar.