The npm package npmscript_tesstalert_unpkg contains malicious code that exfiltrates browser cookies. When its script is loaded in a web page via the unpkg CDN, it reads the document's cookies and redirects the browser to an attacker-controlled URL with the cookies appended. This behavior is obfuscated by splitting sensitive property names to evade detection by string-based scanners. Any site loading this package version risks leaking user cookies to the attacker.