MAL-2026-14211

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sw-pluginer/MAL-2026-14211.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-14211

Published

2026-08-19T02:49:26Z

Modified

2026-08-19T03:00:14.567212331Z

Summary

Malicious code in sw-pluginer (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06)

sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config via require('sw-pluginer') — reads a URL from a staged file at nodemodules/.bin/manifest.json, performs an HTTP GET to that URL, and passes the response body directly to eval() in the Node build process. The staging file is written by a separate dropper component and is unlinked after being read, hiding the payload destination from static inspection of the sw-pluginer tarball itself. The fetched code is not pinned, hashed, or signature-verified, and it is executed in the developer's Node environment (not in a browser as service worker code) — so whoever controls the staged manifest.json obtains arbitrary code execution on the developer machine at build time. The self-deleting indirection through nodemodules/.bin/manifest.json plus eval of unverified network-fetched JavaScript is a covert dropper mechanism, not service worker registration.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:22.208634612Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T02:49:34Z",
            "sha256": "04cb9419a7170f7f1d55a8515c8d931d0a388fdf9b55c692a72a3f447539b650",
            "id": "IN-MAL-2026-018301",
            "versions": [
                "1.1.0"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:22.12018987Z",
            "sha256": "38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06",
            "modified_time": "2026-08-19T02:49:26Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018300",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:22.516514813Z",
            "sha256": "4774f9e54911d1231788224ac0d528431050050cbcc8a053f1f40eb6e73b8ff1",
            "modified_time": "2026-08-19T02:50:02Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018304",
            "versions": [
                "1.2.0"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:22.424629099Z",
            "sha256": "b5f6a7d297091f57fe43af57f951f3acc3f82e51363747e84b87113c13e76212",
            "modified_time": "2026-08-19T02:49:50Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018303",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-19T02:57:22.332600519Z",
            "sha256": "cc3a59d3a151fdca61663452e132622d9f9201013e53a4f57805845c290c5551",
            "modified_time": "2026-08-19T02:49:41Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018302",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / sw-pluginer

Package

Name: sw-pluginer; View open source insights on deps.dev
Purl: pkg:npm/sw-pluginer

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sw-pluginer/MAL-2026-14211.json"

indicators

{
    "evidence_files": [
        {
            "sha256": "ca164ecc2344c5ce1f3ad4e4c75cea4b0fa4c9560f564d59858062d342c93747",
            "tlsh": "b301feaacd81e437057125611806c314e0b7812482239091f3ec93d65ffbc2cd73bcc0",
            "path": "lib/register-worker.js"
        },
        {
            "sha256": "834c8ecadebf0420243421df5d4c24e0dc6cb84fec2c6bbdbea81d99b8cbf657",
            "tlsh": "2b21e4924fdc4997187312905b3b9213e17ec16a6112c2907abf43d53fd302081354fc",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "sw-pluginer-1.1.0.tgz",
            "hashes": {
                "sha1": "930c0a7ce78cca8b8db4bbcef5dd7320a7594d26",
                "sha512_sri": "sha512-MMl1pB9cg2gUGlHc5JJUi5s7Qw78aXNr1R3TocPzjYmY5T0e2lB74N1F5Dd00N3IB3E/o52AIEUGJH58Lz2oow=="
            }
        }
    ]
}

cwes

[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]