{"id":"MAL-2026-16081","summary":"Malicious code in @staticj/cropperxmjs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a)\n@staticj/cropperxmjs@1.6.0 ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code reconstructs the URL https://u.myquickcash.shop/api/spt/upgrade from many single-letter string fragments interleaved with legitimate Cropper.js constants (Qt='https:', Kt='//u.', Vt='my', Ft='quick', Jt='cash', _t='.shop', qt='/api/spt/', $t='upgrade') to defeat simple grep-based detection. It reads GM_info.script metadata (author, name, version, namespace, updateURL), URL-encodes it, and sends it via GM_xmlhttpRequest to that endpoint; the response body is passed to eval(), executing attacker-controlled JavaScript under Tampermonkey/Greasemonkey privileges (GM_* APIs bypass CORS/CSP). Calls are rate-limited to 15/day using GM_setValue key 'sp_req_daily'. The exfiltrated updateURL identifies each victim userscript's auto-update channel, enabling targeted follow-on supply-chain attacks. Any userscript bundling this file exposes its end users to remote code execution controlled by the operator of u.myquickcash.shop.\n","modified":"2026-09-09T15:32:41.752764777Z","published":"2026-09-09T14:51:22Z","database_specific":{"malicious-packages-origins":[{"versions":["1.6.0"],"id":"IN-MAL-2026-019858","import_time":"2026-09-09T15:17:29.187965928Z","modified_time":"2026-09-09T14:51:22Z","sha256":"ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@staticj/cropperxmjs/v/1.6.0"}],"affected":[{"package":{"name":"@staticj/cropperxmjs","ecosystem":"npm","purl":"pkg:npm/%40staticj/cropperxmjs"},"versions":["1.6.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@staticj/cropperxmjs/MAL-2026-16081.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"cropperxmjs-1.6.0.tgz","hashes":{"sha1":"5950c8f310dd200ee9fe77abd899b2887a94269f","sha512_sri":"sha512-R7IYebVdW7zw79eEolJnRwM32+xvgFu6T2F6DBG/JKH5CQDbPucvE7r73REO5u2kf0Y7zEla/+PAlhEVe12G3A=="}}],"evidence_files":[{"path":"cropper.min.js","sha256":"314db418356d8c0230b4ae6834d1339db9e061dbc26e730c29f6e13eafe56f6d","tlsh":"8603f95c7621342a801241a2a42f470ea133b92d6b07c86c727de9d71dbcd9e767fe35"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}