MAL-2026-18455

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/scdn-jquery/MAL-2026-18455.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18455

Published

2026-11-02T06:05:54Z

Modified

2026-11-02T06:15:04Z

Summary

Malicious code in scdn-jquery (npm)

Details

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads https://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to https://oomcsn.cc/assets/js/group.html, which selects iOS exploit code based on the visitor's device version. The loader is embedded in a file presented as jQuery and executes when that browser script runs. No npm install-time execution was identified.

Credits

- ESTsecurity - FINDER

Affected packages

npm / scdn-jquery

Package

Name: scdn-jquery; View open source insights on deps.dev
Purl: pkg:npm/scdn-jquery

Affected ranges

Affected versions

0.*

0.1.6

Database specific

cwes

[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

iocs

{
    "domains":  [
        "oomcsn.cc"
    ],
    "files":  [],
    "ips":  [],
    "urls":  [
        "https://oomcsn.cc/assets/js/m.js",
        "https://oomcsn.cc/assets/js/group.html"
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/scdn-jquery/MAL-2026-18455.json"