MalwarePublished 21 Sep 2026Updated 12 Oct 2026

npmscript_tesstalert_unpkg (npm) · Malicious Code

Affects npmscript_tesstalert_unpkgSource GCVE Database

Malicious package : remove npmscript_tesstalert_unpkg and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:20 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16309

What to do

Remove npmscript_tesstalert_unpkg from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnpmscript_tesstalert_unpkg	Affected 1.0.1 – 1.1.8 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package npmscript_tesstalert_unpkg contains malicious code that exfiltrates browser cookies. When its script is loaded in a web page via the unpkg CDN, it reads the document's cookies and redirects the browser to an attacker-controlled URL with the cookies appended. This behavior is obfuscated by splitting sensitive property names to evade detection by string-based scanners. Any site loading this package version risks leaking user cookies to the attacker.

Impact

Users visiting web pages that load this package version via unpkg risk having their browser cookies stolen and sent to an attacker-controlled server. This can lead to session hijacking or other attacks leveraging stolen cookies. The malicious behavior is client-side and triggered by loading the compromised script.

Defensive guidance

Users and developers should avoid loading or bundling the affected versions (=1.0.1, =1.0.2, =1.1.7, =1.1.8) of npmscript_tesstalert_unpkg. Remove or replace this package with a trusted alternative. Monitor dependencies for updates or vendor advisories for fixes.

Summary

The npmscript_tesstalert_unpkg npm package exposes a script via its unpkg field intended for CDN usage. This script, when executed in a browser context, reads the document.cookie property and redirects the browser to a hardcoded webhook.site URL concatenated with the cookie value. The code uses string concatenation to hide property names such as 'location', 'href', and 'cookie' from static scanners. Versions 1.0.1, 1.0.2, 1.1.7, and 1.1.8 of the package are affected. This results in client-side cookie exfiltration to an attacker-controlled endpoint.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 04:33 UTC

Technical details

References

Community reviews