MAL-2026-16081

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@staticj/cropperxmjs/MAL-2026-16081.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16081
Published
2026-09-09T14:51:22Z
Modified
2026-09-09T15:32:41Z
Summary
Malicious code in @staticj/cropperxmjs (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a)

@staticj/cropperxmjs@1.6.0 ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code reconstructs the URL https://u.myquickcash.shop/api/spt/upgrade from many single-letter string fragments interleaved with legitimate Cropper.js constants (Qt='https:', Kt='//u.', Vt='my', Ft='quick', Jt='cash', t='.shop', qt='/api/spt/', $t='upgrade') to defeat simple grep-based detection. It reads GM_info.script metadata (author, name, version, namespace, updateURL), URL-encodes it, and sends it via GM_xmlhttpRequest to that endpoint; the response body is passed to eval(), executing attacker-controlled JavaScript under Tampermonkey/Greasemonkey privileges (GM* APIs bypass CORS/CSP). Calls are rate-limited to 15/day using GM_setValue key 'sp_req_daily'. The exfiltrated updateURL identifies each victim userscript's auto-update channel, enabling targeted follow-on supply-chain attacks. Any userscript bundling this file exposes its end users to remote code execution controlled by the operator of u.myquickcash.shop.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019858",
            "import_time": "2026-09-09T15:17:29.187965928Z",
            "modified_time": "2026-09-09T14:51:22Z",
            "sha256": "ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a",
            "source": "amazon-inspector",
            "versions": [
                "1.6.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @staticj/cropperxmjs

Package

Name
@staticj/cropperxmjs
View open source insights on deps.dev
Purl
pkg:npm/%40staticj/cropperxmjs

Affected ranges

Affected versions

1.*
1.6.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "cropper.min.js",
            "sha256": "314db418356d8c0230b4ae6834d1339db9e061dbc26e730c29f6e13eafe56f6d",
            "tlsh": "8603f95c7621342a801241a2a42f470ea133b92d6b07c86c727de9d71dbcd9e767fe35"
        }
    ],
    "package_integrity": [
        {
            "filename": "cropperxmjs-1.6.0.tgz",
            "hashes": {
                "sha1": "5950c8f310dd200ee9fe77abd899b2887a94269f",
                "sha512_sri": "sha512-R7IYebVdW7zw79eEolJnRwM32+xvgFu6T2F6DBG/JKH5CQDbPucvE7r73REO5u2kf0Y7zEla/+PAlhEVe12G3A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@staticj/cropperxmjs/MAL-2026-16081.json"