MAL-2026-18455 — Malicious code in scdn-jquery npm package

Version 0.1.6 contains an obfuscated loader that executes when libs/18.2.0.js is served as a browser script. The loader fetches https://oomcsn.cc/assets/js/m.js, which loads a beacon and inserts an invisible iframe to select iOS exploit code. No npm install-time execution was identified.