The scdn-jquery npm package version 0.1.6 contains obfuscated malicious code in the file libs/18.2.0.js. This code loads a remote script that inserts an invisible iframe to deliver iOS-specific exploit code based on the visitor's device version. The malicious loader executes in the browser when the script is served, masquerading as jQuery. There is no evidence of malicious code execution during npm installation.