feed-widget-helper@1.0.0
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16332
Ecosystem
npm
Summary
The package's main entry executes a top-level side effect that reads document.cookie and sends it via fetch to a hardcoded webhook.site collector URL (http://webhook.site/67dba5f1-70f5-413e-9299-2ad886bb77fa) over plain HTTP. Any environment that imports or requires this package leaks its browser cookies to an anonymous third-party listener controlled by the package author. The destination is a webhook.site inbox — an anonymous request-capture service unrelated to any legitimate feed-widget functionality — and the transmission fires unconditionally on load, with no caller opt-in or configuration.
Source: amazon-inspector (b5a81a96715497c25b18687ba7b9b42e919c23e700ede8d9944d41d6052d7f83)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.