MAL-2026-16081
Dashboard / Malicious Package / MAL-2026-16081
MAL-2026-16081
Summary: Malicious code in @staticj/cropperxmjs (npm)
Details: Source: amazon-inspector (ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a) @staticj/[email protected] ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code reconstructs the URL https://u.myquickcash.shop/api/spt/upgrade from many single-letter string fragments interleaved with legitimate Cropper.js constants (Qt='https:', Kt='//u.', Vt='my', Ft='quick', Jt='cash', _t='.shop', qt='/api/spt/', $t='upgrade') to defeat simple grep-based detection. It reads GM_info.script metadata (author, name, version, namespace, updateURL), URL-encodes it, and sends it via GM_xmlhttpRequest to that endpoint; the response body is passed to eval(), executing attacker-controlled JavaScript under Tampermonkey/Greasemonkey privileges (GM_* APIs bypass CORS/CSP). Calls are rate-limited to 15/day using GM_setValue key 'sp_req_daily'. The exfiltrated updateURL identifies each victim userscript's auto-update channel, enabling targeted follow-on supply-chain attacks. Any userscript bundling this file exposes its end users to remote code execution controlled by the operator of u.myquickcash.shop.
Affected packages
Package
Name: @staticj/cropperxmjs
Purl: pkg:npm/%40staticj/cropperxmjs
Affected ranges
Type: N/A
Events:
