MAL-2026-14211

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sw-pluginer/MAL-2026-14211.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14211
Published
2026-08-19T02:49:26Z
Modified
2026-08-19T03:00:14Z
Summary
Malicious code in sw-pluginer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06)

sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config via require('sw-pluginer') — reads a URL from a staged file at node_modules/.bin/manifest.json, performs an HTTP GET to that URL, and passes the response body directly to eval() in the Node build process. The staging file is written by a separate dropper component and is unlinked after being read, hiding the payload destination from static inspection of the sw-pluginer tarball itself. The fetched code is not pinned, hashed, or signature-verified, and it is executed in the developer's Node environment (not in a browser as service worker code) — so whoever controls the staged manifest.json obtains arbitrary code execution on the developer machine at build time. The self-deleting indirection through node_modules/.bin/manifest.json plus eval of unverified network-fetched JavaScript is a covert dropper mechanism, not service worker registration.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-018301",
            "import_time":  "2026-08-19T02:57:22.208634612Z",
            "modified_time":  "2026-08-19T02:49:34Z",
            "sha256":  "04cb9419a7170f7f1d55a8515c8d931d0a388fdf9b55c692a72a3f447539b650",
            "source":  "amazon-inspector",
            "versions":  [
                "1.1.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-018300",
            "import_time":  "2026-08-19T02:57:22.12018987Z",
            "modified_time":  "2026-08-19T02:49:26Z",
            "sha256":  "38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-018304",
            "import_time":  "2026-08-19T02:57:22.516514813Z",
            "modified_time":  "2026-08-19T02:50:02Z",
            "sha256":  "4774f9e54911d1231788224ac0d528431050050cbcc8a053f1f40eb6e73b8ff1",
            "source":  "amazon-inspector",
            "versions":  [
                "1.2.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-018303",
            "import_time":  "2026-08-19T02:57:22.424629099Z",
            "modified_time":  "2026-08-19T02:49:50Z",
            "sha256":  "b5f6a7d297091f57fe43af57f951f3acc3f82e51363747e84b87113c13e76212",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-018302",
            "import_time":  "2026-08-19T02:57:22.332600519Z",
            "modified_time":  "2026-08-19T02:49:41Z",
            "sha256":  "cc3a59d3a151fdca61663452e132622d9f9201013e53a4f57805845c290c5551",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sw-pluginer

Package

Name
sw-pluginer
View open source insights on deps.dev
Purl
pkg:npm/sw-pluginer

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/register-worker.js",
            "sha256":  "ca164ecc2344c5ce1f3ad4e4c75cea4b0fa4c9560f564d59858062d342c93747",
            "tlsh":  "b301feaacd81e437057125611806c314e0b7812482239091f3ec93d65ffbc2cd73bcc0"
        },
        {
            "path":  "index.js",
            "sha256":  "834c8ecadebf0420243421df5d4c24e0dc6cb84fec2c6bbdbea81d99b8cbf657",
            "tlsh":  "2b21e4924fdc4997187312905b3b9213e17ec16a6112c2907abf43d53fd302081354fc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "sw-pluginer-1.1.0.tgz",
            "hashes":  {
                "sha1":  "930c0a7ce78cca8b8db4bbcef5dd7320a7594d26",
                "sha512_sri":  "sha512-MMl1pB9cg2gUGlHc5JJUi5s7Qw78aXNr1R3TocPzjYmY5T0e2lB74N1F5Dd00N3IB3E/o52AIEUGJH58Lz2oow=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sw-pluginer/MAL-2026-14211.json"