Which versions of my-cdn-script are malicious?

The following npm versions of my-cdn-script are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate my-cdn-script if I installed it?

my-cdn-script is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed my-cdn-script — how do I know if it already compromised me?

If my-cdn-script was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is my-cdn-script part of a known attack campaign?

Yes — my-cdn-script is associated with the IN-MAL-2026-020237 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find my-cdn-script across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for my-cdn-script (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging my-cdn-script across your stack and pipelines.

Malicious package

my-cdn-scriptnpm

my-cdn-script is a confirmed malicious npm package (MAL-2026-16337) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in my-cdn-script (npm)

MAL-2026-16337

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall my-cdn-script

What this malware does

[email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form into the Alpha Bank hosted payment method and captures the card number, expiry, CVC together with the shopper's name, address, city, region, postcode, phone, and page origin. The concatenated payload is encoded byte-by-byte, wrapped in a Blob with type 'image/png' to disguise it as an image upload, and POSTed to the hardcoded attacker endpoint https://ungpkg.top/gate. The script uses uniform bracket-notation property access to defeat static string scans, sets a sessionStorage flag to avoid re-sending, and gates itself off when admin-panel cookies/localStorage keys (psAdminLang, psAdminTab, psAdminTheme, _ga_8F4XM9P3R51) are present so a merchant testing their own checkout does not observe the theft. Any site that includes this package on its checkout page will have its customers' payment card data and PII silently harvested and sent to ungpkg.top.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for my-cdn-script (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging my-cdn-script across your stack and pipelines.
If you installed it — respond
my-cdn-script is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If my-cdn-script was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks my-cdn-script before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. my-cdn-script on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020237

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks my-cdn-script-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database