scdn-jquery

GHSA-543q-wq5f-hmgh

Malicious code in scdn-jquery (npm)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.6`

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to https://oomcsn.cc/assets/js/group.html, which selects iOS exploit code based on the visitor's device version. The loader is embedded in a file presented as jQuery and executes when that browser script runs. No npm install-time execution was identified.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/6007f07e3dbabcc1eaa382552bd73171cfe8f30a/osv/malicious/npm/scdn-jquery/MAL-2026-18455.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/6007f07e3dbabcc1eaa382552bd73171cfe8f30a/osv/malicious/npm/scdn-jquery/MAL-2026-18455.json
- https://github.com/advisories/GHSA-543q-wq5f-hmgh

Compromised versions (1)

= 0.1.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.