Malicious package: a browser-side session and content exfiltration payload published to npm solely to obtain hosting on a public CDN. The package declares no install scripts and no dependencies, so it is inert during npm install; its single file is intended to be loaded into a victim web page via a script tag from a package CDN such as unpkg, which mirrors every published npm package automatically. A Content Security Policy that allowlists the CDN origin trusts every package on npm, so this file passes a policy that would block an inline script or a script from an attacker-controlled domain. Once loaded it executes in the victim origin, sending document.cookie and the current URL to an external collector at webhook.site, then fetching a list of paths including /admin, /dev and /dashboard with credentials included and beaconing the first 3000 characters of each authenticated response, and finally scanning the page and those responses for a flag pattern. The description field reads ctf and the payload targets a capture-the-flag style bot, but the published artifact performs live, unconditional session-cookie and authenticated-content theft against any origin that loads it.