OpenSSF/OSV advisory MAL-2026-3667 confirms this npm version as malicious. The package's entire content (xss.js) is a 2-line cookie-stealing payload that creates an Image element pointing to https://collaborator.gbrls.workers.dev/ with base64-encoded document.cookie appended. This is a textbook XSS cookie exfiltration primitive targeting an attacker-controlled Cloudflare Workers endpoint...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in 0ctf-chalweb (npm)
Details
The package's entire content (xss.js) is a 2-line cookie-stealing payload that creates an Image element pointing to https://collaborator.gbrls.workers.dev/ with base64-encoded document.cookie appended. This is a textbook XSS cookie exfiltration primitive targeting an attacker-controlled Cloudflare Workers endpoint. Regardless of whether this was published as a CTF artifact, any consumer who installs and bundles this package into a web app will exfiltrate end-users' cookies. There is no legitimate use case for publishing a cookie-exfil snippet to the public npm registry.
Decision reason
OSV/OpenSSF confirms 0ctf-chalweb@1.0.0 as malicious package MAL-2026-3667. Malicious code in 0ctf-chalweb (npm)