Which versions of npmscript_tesstalert_unpkg are malicious?

The following npm versions of npmscript_tesstalert_unpkg are flagged malicious: 1.0.1, 1.0.2, 1.1.7, 1.1.8. Treat any of these as compromised.

How do I remediate npmscript_tesstalert_unpkg if I installed it?

npmscript_tesstalert_unpkg is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed npmscript_tesstalert_unpkg — how do I know if it already compromised me?

If npmscript_tesstalert_unpkg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is npmscript_tesstalert_unpkg part of a known attack campaign?

Yes — npmscript_tesstalert_unpkg is associated with the IN-MAL-2026-020199, IN-MAL-2026-020203, IN-MAL-2026-020278, IN-MAL-2026-020279, GHSA-xvj9-j5xj-9f5p campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find npmscript_tesstalert_unpkg across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for npmscript_tesstalert_unpkg (4 malicious versions).

Malicious package

npmscript_tesstalert_unpkgnpm

Advisory published Sep 21, 2026Updated Oct 12, 2026

npmscript_tesstalert_unpkg is a confirmed malicious npm package (MAL-2026-16309) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.1, 1.0.2, 1.1.7…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in npmscript_tesstalert_unpkg (npm)

MAL-2026-16309

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall npmscript_tesstalert_unpkg

What this malware does

The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads document.cookie and assigns window.location.href to https://webhook.site/4c14c8e4-721e-471d-807c-1a2aa216512a/ concatenated with the cookie value, causing the browser to navigate to that attacker-controlled endpoint carrying the victim's cookies. The identifiers location, href, and cookie are assembled from split fragments ("loca"+"tion", "hr"+"ef", "coo"+"kie") to hide the sensitive property accesses from string-based scanners. Any page that loads this file via unpkg or bundles it exfiltrates its cookies to the hardcoded webhook.site collector.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

4 flagged

1.0.11.0.21.1.71.1.8

Indicators of compromise (SHA-256)

5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b

c777bbe58b3d69665fe68a18fced15bddf5b2af8c9fc19daac7fc5b886188330

3768ce94b4529af0a60d4781cbb2dd69230e7781efb440e0a9c4fc5dcc7121da

8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627

efdb5fd9b7105d7d7bad5ef86b67ee09c7b8d936866298e6dab1da36329d1641

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for npmscript_tesstalert_unpkg (4 malicious versions).
If you installed it — respond
npmscript_tesstalert_unpkg is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If npmscript_tesstalert_unpkg was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. npmscript_tesstalert_unpkg on npm has been identified as a malicious package (versions 1.0.1, 1.0.2, 1.1.7, 1.1.8 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020199IN-MAL-2026-020203IN-MAL-2026-020278IN-MAL-2026-020279GHSA-xvj9-j5xj-9f5p

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks npmscript_tesstalert_unpkg-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database