{"id":"MAL-2026-18455","kind":"package","aliases":["MAL-2026-18455"],"related":[],"title":"Malicious code in scdn-jquery (npm)","description":"Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to https://oomcsn.cc/assets/js/group.html, which selects iOS exploit code based on the visitor's device version. The loader is embedded in a file presented as jQuery and executes when that browser script runs. No npm install-time execution was identified.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"scdn-jquery","fixed":[],"affected":"= 0.1.6","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T06:05:54+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","triaged_at":"2026-11-02T07:22:18+00:00","updated_at":"2026-11-02T07:24:32+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18455':10A,13A '-2026':9A,12A '/assets/js/group.html,':61C '/assets/js/m.js.':45C '0.1.6':20C 'base':67C 'beacon':51C 'browser':35C,88C 'code':2A,39C,66C 'contain':21C 'decod':40C 'devic':72C 'embed':77C 'execut':85C,96C 'exploit':65C 'file':32C,80C 'identifi':98C 'ifram':56C 'inject':38C 'insert':53C 'instal':94C 'install-tim':93C 'invis':55C 'io':64C 'jqueri':6A,83C 'jquery':16A 'libs/18.2.0.js':26C 'load':42C,49C 'loader':24C,75C 'mal':8A,11A 'malici':1A,17B 'npm':7A,92C 'obfusc':23C 'oomcsn.cc':44C,60C 'oomcsn.cc/assets/js/group.html,':59C 'oomcsn.cc/assets/js/m.js.':43C 'packag':18B 'point':57C 'present':81C 'remot':47C 'run':90C 'scdn':5A,15A 'scdn-jqueri':4A 'scdn-jquery':14A 'script':36C,48C,89C 'select':63C 'serv':30C 'time':95C 'version':19C,73C 'visitor':70C 'websit':29C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["scdnjquery"],"ptokens":["jquery","scdn"],"labels":["critical","malicious","npm","package"],"first_public_at":"2026-11-02T06:05:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18455","url":"https://osv.dev/vulnerability/MAL-2026-18455","severity":"critical","published_at":"2026-11-02T06:05:54+00:00","modified_at":"2026-11-02T06:15:04+00:00","first_seen_at":"2026-11-02T07:21:41+00:00","fetched_at":"2026-11-02T07:21:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}