@staticj/cropperxmjs@1.6.0

Analysis

@staticj/cropperxmjs@1.6.0 is a trojanized clone of the Cropper.js image-cropping library. Both cropper.min.js and cropper.test.min.js contain an injected block inside the cropMove handler that reads userscript metadata (author, name, version, namespace, updateURL) and sends an HTTP GET to hxxps://u[.]myquickcash[.]shop/api/spt/upgrade?author=[.][.][.]&name=[.][.][.]&version=[.][.][.]&namespace=[.][.][.]&updateURL=[.][.][.]&timestamp=[.][.]. The response body is passed to eval(), executing arbitrary remote code supplied by the server. The beacon is rate-limited to 15 requests per day via GM_getValue/GM_setValue storage. This is a remote-code-execution / second-stage loader.