MAL-2026-10427

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/svg-fetcher/MAL-2026-10427.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10427
Published
2026-07-13T08:10:00Z
Modified
2026-07-13T09:17:04.146073108Z
Summary
Malicious code in svg-fetcher (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f)

index.js exports getPlugin(), which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field data.credits to new Function(require, module, exports,..., Promise, data.credits), executing attacker-controlled JavaScript with full Node privileges (require, process, Buffer, globals available to the injected function). A sibling export setDefaultModule() constructs a benign-looking cdnjs font-awesome URL that matches the README's advertised SVG-fetching purpose but is never used by getPlugin(), serving as a cover story for the remote loader. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with Windows DPAPI credential/browser-database access that a downloaded payload could invoke. The tarball also ships an unencrypted ed25519 OpenSSH private key (file 'gitlab' with comment testm@DESKTOP-PO28IS1) and its matching public key; the key is not read by the loader and represents an author-side exposure rather than an installer-side attack path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f",
            "modified_time": "2026-07-13T08:10:00Z",
            "versions": [
                "2.4.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009862",
            "import_time": "2026-07-13T09:10:55.95635962Z"
        }
    ]
}
References
Credits

Affected packages

npm / svg-fetcher

Package

Name
svg-fetcher
View open source insights on deps.dev
Purl
pkg:npm/svg-fetcher

Affected ranges

Affected versions

2.*
2.4.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "24f9b188fee5ca7999bd67fc8c2ad3b5b7bb558ecc1db3c118783ffba5bd180c",
            "tlsh": "dfc1616546fa21a36a67e4edf30f100271a5e2133758e971f48e42902fca668e5f24e8",
            "path": "index.js"
        },
        {
            "sha256": "1b518991648a8f55ae87fef0521f62db50ffec33ee374a144949bd4d6739aabb",
            "tlsh": "aae0edb26c6d6e8a69aecef81820810a9f69f6a3493870e041e4e0852d75ea2c41c6c4",
            "path": "gitlab"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Kaeu/3twuFrthSB9abToI0RJ1wh5hl293wr5DpB9TT7DYSgdlqcvgr29QoqH0UA71WsSP1meyatRrSQOry/djg==",
                "sha1": "9b7fc05d9df61c3a8dce668699ce73ccd04a9c0e"
            },
            "filename": "svg-fetcher-2.4.1.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/svg-fetcher/MAL-2026-10427.json"