MAL-2026-16081
Malicious code in @staticj/cropperxmjs (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a) @staticj/cropperxmjs@1.6.0 ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code reconstructs the URL https://u.myquickcash.shop/api/spt/upgrade from many single-letter string fragments interleaved with legitimate Cropper.js constants (Qt='https:', Kt='//u.', Vt='my', Ft='quick', Jt='cash', _t='.shop', qt='/api/spt/', $t='upgrade') to defeat simple grep-based detection. It reads GM_info.script metadata (author, name, version, namespace, updateURL), URL-encodes it, and sends it via GM_xmlhttpRequest to that endpoint; the response body is passed to eval(), executing attacker-controlled JavaScript under Tampermonkey/Greasemonkey privileges (GM_* APIs bypass CORS/CSP). Calls are rate-limited to 15/day using GM_setValue key 'sp_req_daily'. The exfiltrated updateURL identifies each victim userscript's auto-update channel, enabling targeted follow-on supply-chain attacks. Any userscript bundling this file exposes its end users to remote code execution controlled by the operator of u.myquickcash.shop.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @staticj/cropperxmjs (npm). Pin to a known-safe version or switch to an alternative.