my-ctf-helper-script-9921@1.0.0
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 11:45 PM UTC
OSV ID
MAL-2026-16365
Ecosystem
npm
Summary
On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL https://webhook.site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/, appending document.cookie as a query-string parameter. The package has no other advertised functionality; the sole effect of loading it is to send the ambient cookie value to a third-party webhook capture endpoint controlled by whoever provisioned that webhook.site token. webhook.site is a generic ad-hoc data-collection service, unrelated to any legitimate publisher infrastructure.
Source: amazon-inspector (41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.