MAL-2026-13985

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-config-svg-contract/MAL-2026-13985.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13985
Published
2026-08-13T21:11:35Z
Modified
2026-08-13T21:30:27.307521645Z
Summary
Malicious code in node-config-svg-contract (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1)

The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017704",
            "import_time": "2026-08-13T21:20:58.405907495Z",
            "sha256": "f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:11:35Z"
        }
    ]
}
References
Credits

Affected packages

npm / node-config-svg-contract

Package

Name
node-config-svg-contract
View open source insights on deps.dev
Purl
pkg:npm/node-config-svg-contract

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/node-config-svg-contract/MAL-2026-13985.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "10b1355914e261128772ebfc5a8bc515f734f2237281c299bd9e86c02fb6560a273edc",
            "sha256": "3ea767ec14d82d321974e85eb8d97aab675e9661eaba5bd5ed488a8923b8ef9a"
        }
    ],
    "package_integrity": [
        {
            "filename": "node-config-svg-contract-1.0.0.tgz",
            "hashes": {
                "sha1": "f0129bee5bcd4457be81b3f277956beca8878c96",
                "sha512_sri": "sha512-1AJCuy0zz2GCa5+QzQvZYdGjHOt6mywVYv0rRjyt8XYDdT3jwckIvfSjBjYf9+Lo6K/upEMBcoXQFKp0XiE9Yg=="
            }
        }
    ]
}