{"id":"MAL-2026-18455","summary":"Malicious code in scdn-jquery (npm)","details":"Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to https://oomcsn.cc/assets/js/group.html, which selects iOS exploit code based on the visitor's device version. The loader is embedded in a file presented as jQuery and executes when that browser script runs. No npm install-time execution was identified.","modified":"2026-11-02T06:15:04.805072894Z","published":"2026-11-02T06:05:54Z","affected":[{"package":{"name":"scdn-jquery","ecosystem":"npm","purl":"pkg:npm/scdn-jquery"},"versions":["0.1.6"],"database_specific":{"iocs":{"files":[],"ips":[],"urls":["https://oomcsn.cc/assets/js/m.js","https://oomcsn.cc/assets/js/group.html"],"domains":["oomcsn.cc"]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/scdn-jquery/MAL-2026-18455.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.9.2","credits":[{"name":"ESTsecurity","type":"FINDER"}]}