Responding to a jQuery ScrollTo Malware Infection

When a popular JavaScript library is compromised, the infection spreads quietly because many sites trust the same file and reuse the same deployment habits. In this case the danger was not only the script itself, but the assumption that frontend utility files were “safe enough” to ignore.

What to Do Immediately

• replace the compromised file with a clean copy from a verified source
• scan all reused libraries, not just the one where the payload was found
• rotate credentials and review who had write access to the affected server
• check deployment archives so the malware does not return with the next upload

If one shared script was altered, treat the event as a supply-path problem until proven otherwise.