Trojanized jQuery Packages Found on npm, GitHub, and jsDelivr Code Repositories

Researchers identified a complex supply-chain campaign in which threat actors published approximately 68 trojanized jQuery packages to npm (and hosted the modified library via GitHub/jsDelivr) during May–June 2024. The malicious code, hidden in the rarely used 'end' function (invoked by 'fadeTo'), exfiltrates website form data to a remote URL; the packages appear manually assembled across many accounts and names to evade detection.