my-ctf-helper-script-9921

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409)
On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL https://webhook.site/99e9df7b-fe86-4c60-822a-5352b1f9edf0/, appending document.cookie as a query-string parameter. The package has no other advertised functionality; the sole effect of loading it is to send the ambient cookie value to a third-party webhook capture endpoint controlled by whoever provisioned that webhook.site token. webhook.site is a generic ad-hoc data-collection service, unrelated to any legitimate publisher infrastructure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8b22724c6b21215e1887acbd30e4ea6c5cef5d35/osv/malicious/npm/my-ctf-helper-script-9921/MAL-2026-16365.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8b22724c6b21215e1887acbd30e4ea6c5cef5d35/osv/malicious/npm/my-ctf-helper-script-9921/MAL-2026-16365.json
- https://www.npmjs.com/package/my-ctf-helper-script-9921/v/1.0.0
- https://github.com/advisories/GHSA-qhgh-m36j-h879

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.