pf25133@1.0.0
Vulnerability report · Last retrieved from osv.dev September 21, 2026 at 7:43 AM UTC
OSV ID
MAL-2026-16339
Ecosystem
npm
Summary
The package's declared main module index.js is an IIFE that reads document.cookie, fetches a hardcoded list of application paths, extracts flag-shaped patterns from the responses, and POSTs the aggregated data as JSON to a hardcoded webhook.site collector URL (https://webhook.site/c4e39647-bfb8-47ef-b6d4-a112aacc6cd1). The behavior is unconditional on load and the destination is not configurable. webhook.site is a generic anonymous request-bin service unrelated to any legitimate first-party endpoint, and the package ships no functionality other than this collection payload.
Source: amazon-inspector (504c3f95c937a05e14c220c767a0e18f4cada866ee5eebad0749457232ace73b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.