MAL-2026-16337

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/my-cdn-script/MAL-2026-16337.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16337
Published
2026-09-21T03:31:51Z
Modified
2026-09-21T04:00:06Z
Summary
Malicious code in my-cdn-script (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b)

my-cdn-script@1.0.0 ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form into the Alpha Bank hosted payment method and captures the card number, expiry, CVC together with the shopper's name, address, city, region, postcode, phone, and page origin. The concatenated payload is encoded byte-by-byte, wrapped in a Blob with type 'image/png' to disguise it as an image upload, and POSTed to the hardcoded attacker endpoint https://ungpkg.top/gate. The script uses uniform bracket-notation property access to defeat static string scans, sets a sessionStorage flag to avoid re-sending, and gates itself off when admin-panel cookies/localStorage keys (psAdminLang, psAdminTab, psAdminTheme, _ga_8F4XM9P3R51) are present so a merchant testing their own checkout does not observe the theft. Any site that includes this package on its checkout page will have its customers' payment card data and PII silently harvested and sent to ungpkg.top.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020237",
            "import_time":  "2026-09-21T03:46:38.67464314Z",
            "modified_time":  "2026-09-21T03:31:51Z",
            "sha256":  "e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / my-cdn-script

Package

Name
my-cdn-script
View open source insights on deps.dev
Purl
pkg:npm/my-cdn-script

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "script.js",
            "sha256":  "94063bdcc9ad5ed2cf9e9b20a500d8a3096116061b70c0343aeb1abd86b77632",
            "tlsh":  "ca12c8b0b610d2fd938dcd6b46b5907e95390b53a003abc5d94dfc646d60a43aaac8cd"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "my-cdn-script-1.0.0.tgz",
            "hashes":  {
                "sha1":  "f07cd99b6f216cdb5d790a235cc8c34df6068f75",
                "sha512_sri":  "sha512-X3ZNQgUvuFXMnqQkyehHBgs9sZT97jRWR2Sg3cUtdgvYv+j+Gmla5aixuRAiT1L5Bb9eFQKPlAxGMdPiEV4IfQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/my-cdn-script/MAL-2026-16337.json"