Logo
npm

my-ctf-helper-script-9921@1.0.0

Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 11:45 PM UTC

Malicious

OSV ID

MAL-2026-16365

Ecosystem

npm

Summary

On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL https://webhook.site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/, appending document.cookie as a query-string parameter. The package has no other advertised functionality; the sole effect of loading it is to send the ambient cookie value to a third-party webhook capture endpoint controlled by whoever provisioned that webhook.site token. webhook.site is a generic ad-hoc data-collection service, unrelated to any legitimate publisher infrastructure.

Source: amazon-inspector (41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.