scdn-jquery@0.1.6
内部测试包，请勿使用
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe bundle runs concealed code at load time and uses it to inject JavaScript from an unrelated external host. This is malicious remote code execution behavior, unrelated to the package’s stated jQuery purpose.
Decision evidence
public snapshot- The published JavaScript bundle contains a concealed payload that is decoded and executed immediately with `new Function`.
- Decoding the payload reveals code that adds a script element pointing to `https://oomcsn.cc/assets/js/m.js`.
- The manifest declares no install or lifecycle scripts; its only scripts are `test` and `build`.
- The package describes itself as a jQuery library, but its manifest points `main` to `index.js`, which is absent from the package snapshot.
Source & flagged code
3 flaggedThe published JavaScript bundle contains a concealed payload that is decoded and executed immediately with `new Function`.
libs/18.2.0.jsView on unpkg · L2Decoding the payload reveals code that adds a script element pointing to `https://oomcsn.cc/assets/js/m.js`.
libs/18.2.0.jsView on unpkg · L2Package source references a known benign dynamic code generation pattern.
libs/18.2.0.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to scdn-jquery@0.1.6.
See all versions of scdn-jquery for other recorded verdicts.
- Avoid installing scdn-jquery@0.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.