@staticj/cropperjs@1.6.0

Analysis

@staticj/cropperjs is a combosquat clone of the legitimate cropperjs image-cropping library that ships a remote-code-execution beacon. On module load, cropper.min.js runs an injected IIFE inside the cropMove handler that uses Greasemonkey/Tampermonkey APIs (GM_getValue/GM_setValue/GM_xmlhttpRequest) to rate-limit itself to 15 requests/day, then sends a GET to hxxps://u[.]myquickcash[.]shop/api/spt/upgrade?author=[.][.][.]&name=[.][.][.]&version=[.][.][.]&namespace=[.][.][.]&updateURL=[.][.][.]&timestamp=[.][.]. and executes the response with eval(), giving the remote server arbitrary code execution in the page. The C2 host is u[.]myquickcash[.]shop.