@staticj/cropperxmjs@1.6.0

Summary

@staticj/cropperxmjs@1.6.0 ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code reconstructs the URL https://u.myquickcash.shop/api/spt/upgrade from many single-letter string fragments interleaved with legitimate Cropper.js constants (Qt='https:', Kt='//u.', Vt='my', Ft='quick', Jt='cash', _t='.shop', qt='/api/spt/', $t='upgrade') to defeat simple grep-based detection. It reads GM_info.script metadata (author, name, version, namespace, updateURL), URL-encodes it, and sends it via GM_xmlhttpRequest to that endpoint; the response body is passed to eval(), executing attacker-controlled JavaScript under Tampermonkey/Greasemonkey privileges (GM_* APIs bypass CORS/CSP). Calls are rate-limited to 15/day using GM_setValue key 'sp_req_daily'. The exfiltrated updateURL identifies each victim userscript's auto-update channel, enabling targeted follow-on supply-chain attacks. Any userscript bundling this file exposes its end users to remote code execution controlled by the operator of u.myquickcash.shop.

Source: amazon-inspector (ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a)