npmscript_tesstalert_unpkg@1.0.1

Analysis

The package's main entry script.js executes a cookie-theft beacon: it loads a remote image URL that exfiltrates the browser's document.cookie to the attacker-controlled collector hxxps://webhook[.]site/c226090c-12b0-462e-81d2-e632c7a58833/?cookie=<cookie value>. Any page that loads this script sends the visitor's session cookies to the external webhook[.]site endpoint.