my-ctf-helper-script-9921@1.0.0

Analysis

The package ships a single script (index.js) that reads the browser document.cookie and POSTs it to an attacker-controlled webhook[.]site endpoint (hxxps://webhook[.]site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/?cookie=[.][.][.]). It is a cookie-theft exfiltration beacon: any page that loads this script leaks the visitor's session cookies to the remote host.