npmscript_tesstalert_unpkg@1.1.8
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 11:45 PM UTC
OSV ID
MAL-2026-16309
Ecosystem
npm
Summary
The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads document.cookie and assigns window.location.href to https://webhook.site/4c14c8e4-721e-471d-807c-1a2aa216512a/ concatenated with the cookie value, causing the browser to navigate to that attacker-controlled endpoint carrying the victim's cookies. The identifiers location, href, and cookie are assembled from split fragments ("loca"+"tion", "hr"+"ef", "coo"+"kie") to hide the sensitive property accesses from string-based scanners. Any page that loads this file via unpkg or bundles it exfiltrates its cookies to the hardcoded webhook.site collector.
Source: amazon-inspector (8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.