@itsreduxtm/unpkg-xss-test @1.0.9
Vulnerability report · Last retrieved from osv.dev August 7, 2026 at 2:10 AM UTC
OSV ID
MAL-2026-13431
Ecosystem
npm
Summary
payload.js is declared as the package main and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from https://unpkg.com/@itsreduxtm/unpkg-xss-test@1.0.4/binlist.txt and issues concurrent HEAD requests to https://entretienextremejb.ca/bin/<name> for each entry, sourcing the traffic from the installer's machine and IP address. The package name ( unpkg-xss-test ) and GTFOBins-style wordlist shape indicate this is a browser XSS-delivered path-enumeration payload; when loaded in Node (fetch is global in Node 18+), the installer conducts the scan against a third party. This covertly weaponizes the installer's identity for reconnaissance against an unrelated site, exposing the installer to abuse reports, IP blocklisting, and potential legal complaints for unauthorized scanning.
Source: amazon-inspector (39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.