scdn-jquery (npm) 0.1.6: jQuery-disguised loader serves per-device iOS exploits via oomcsn.cc (per advisory)
Severity: high · Patch status: no-fix-needed · Since 2026-10-26
The npm package scdn-jquery 0.1.6, published 2026-10-26, contains an obfuscated loader in libs/18.2.0.js that is presented as jQuery. When a website serves that file to browsers, the code decodes and loads https://oomcsn.cc/assets/js/m.js, which starts a beacon and inserts a hidden iframe to group.html. The GitHub advisory says that page selects iOS exploit code by the visitor's device version. The advisory found no install-time execution, so the exposure is to sites that serve the file to visitors, not to build systems. The package was created on 2026-10-24 and every version is published by one npm account, cdnjsv2; its description reads as an internal test package not to be used. It is not a hijack of an established package, and no source names a package it imitates. npm reports 1,456 downloads for 2026-10-23 to 2026-10-29. Version 0.1.7, published 2026-11-01, is outside the advisory's range and has not been checked. No source names an exploit kit, CVE or exploit, and no independent writeup was found. No vendor patch exists: remove the package at every version and audit served scripts for the loader.
What to do
- Remove scdn-jquery at every version, including 0.1.7 (published 2026-11-01, outside the advisory's range), and search lockfiles and served assets for libs/18.2.0.js
- Purge libs/18.2.0.js from web assets and CDN origins, then invalidate CDN caches for it
- Search web, proxy and CDN logs for oomcsn.cc, especially /assets/js/m.js and /assets/js/group.html
- If any site serving this file had iOS visitors, treat it as a possible browser-exploitation incident and review those sessions
- Audit other served scripts for obfuscated loaders that decode and inject remote script tags
Sources
All live incidents on Threat Watch
