confx1789550882@1.0.0
Vulnerability report · Last retrieved from osv.dev September 17, 2026 at 7:36 PM UTC
OSV ID
MAL-2026-16260
Ecosystem
npm
Summary
The package's main file index.js is an IIFE that, when loaded in a browser same-origin context (e.g. via unpkg), reads location.href and document.cookie, fetches authenticated endpoints such as /profile, /admin, /dev, /flag, and /me with credentials:'include', and POSTs the responses along with a matched flag pattern to the hardcoded webhook https://webhook.site/04d98207-c947-4938-9f0c-f92feae051cb/. package.json contains only a 'ctf' description with no author or repository, and the single shipped artifact is this exfiltration payload. Comments in the file describe it as an unpkg-hosted exfil payload.
Source: amazon-inspector (72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.