GHSA-hvpp-rx4h-crg5: Malicious code in scdn-jquery (npm)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
npm/scdn-jqueryfrom your environment.Remove the scdn-jquery package; removing it may not eliminate all malicious software because the computer may have been fully compromised.
- Operational
Rotate all secrets and keys stored on any computer that has scdn-jquery installed or running, immediately and from a different computer.
Event History
Frequently Asked Questions
Which systems and users are exposed to the browser-delivered payload?
Systems that serve libs/18.2.0.js as a browser script expose visitors to the injected loader. The remote payload includes an invisible iframe that selects iOS exploit code based on the visitor's device version.
Does installing the package automatically execute the malicious code?
No npm install-time execution was identified. The embedded loader executes when the file presented as jQuery is run as a browser script.
What should be done if this package is found on a system?
Treat the computer as fully compromised and rotate all secrets and keys from a different computer immediately. Remove the package, but do not assume removal eliminates all malicious software because an outside entity may have obtained full control.
How can I identify the known malicious component?
Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When executed in a browser, it decodes and loads a remote script from oomcsn[.]cc, which then loads a beacon and inserts an invisible iframe.