MAL-2026-16337
Malicious code in my-cdn-script (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b) my-cdn-script@1.0.0 ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form into the Alpha Bank hosted payment method and captures the card number, expiry, CVC together with the shopper's name, address, city, region, postcode, phone, and page origin. The concatenated payload is encoded byte-by-byte, wrapped in a Blob with type 'image/png' to disguise it as an image upload, and POSTed to the hardcoded attacker endpoint https://ungpkg.top/gate. The script uses uniform bracket-notation property access to defeat static string scans, sets a sessionStorage flag to avoid re-sending, and gates itself off when admin-panel cookies/localStorage keys (psAdminLang, psAdminTab, psAdminTheme, _ga_8F4XM9P3R51) are present so a merchant testing their own checkout does not observe the theft. Any site that includes this package on its checkout page will have its customers' payment card data and PII silently harvested and sent to ungpkg.top.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for my-cdn-script (npm). Pin to a known-safe version or switch to an alternative.