Which versions of my-cdn-script are malicious?

The following npm versions of my-cdn-script are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate my-cdn-script if I installed it?

my-cdn-script is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed my-cdn-script — how do I know if it already compromised me?

If my-cdn-script was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is my-cdn-script part of a known attack campaign?

Yes — my-cdn-script is associated with the IN-MAL-2026-020237 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find my-cdn-script across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for my-cdn-script (version 1.0.0).

Malicious package

my-cdn-scriptnpm

Advisory published Sep 21, 2026Updated Sep 21, 2026

my-cdn-script is a confirmed malicious npm package (MAL-2026-16337) that steals credentials and exfiltrates sensitive data (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in my-cdn-script (npm)

MAL-2026-16337

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall my-cdn-script

What this malware does

[email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form into the Alpha Bank hosted payment method and captures the card number, expiry, CVC together with the shopper's name, address, city, region, postcode, phone, and page origin. The concatenated payload is encoded byte-by-byte, wrapped in a Blob with type 'image/png' to disguise it as an image upload, and POSTed to the hardcoded attacker endpoint https://ungpkg.top/gate. The script uses uniform bracket-notation property access to defeat static string scans, sets a sessionStorage flag to avoid re-sending, and gates itself off when admin-panel cookies/localStorage keys (psAdminLang, psAdminTab, psAdminTheme, _ga_8F4XM9P3R51) are present so a merchant testing their own checkout does not observe the theft. Any site that includes this package on its checkout page will have its customers' payment card data and PII silently harvested and sent to ungpkg.top.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for my-cdn-script (version 1.0.0).
If you installed it — respond
my-cdn-script is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If my-cdn-script was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. my-cdn-script on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020237

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks my-cdn-script-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database