MAL-2026-14251

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ngsw-config/MAL-2026-14251.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14251
Published
2026-08-19T04:18:35Z
Modified
2026-08-19T05:00:16.251276899Z
Summary
Malicious code in ngsw-config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd)

The package's postinstall lifecycle script collects installer host identifiers (hostname, platform, architecture, Node version, package/lifecycle name, timestamp) and POSTs them as JSON to the hardcoded endpoint https://wxc97jnc.instances.poc.jchunt.top/ngsw-config on npm install, with no consent, documentation, or opt-out. The package name shadows Angular's legitimate ngsw-config tooling, matching a dependency-confusion canary pattern in which internal build systems that misresolve the name automatically report identifying metadata to the operator of the poc.jchunt.top host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T04:47:46.668906438Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T04:18:35Z",
            "sha256": "8b427c73f093ad680033b2779c43c1c96186a71055aaff3cf44befd18c2cecbd",
            "id": "IN-MAL-2026-018358",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ngsw-config

Package

Name
ngsw-config
View open source insights on deps.dev
Purl
pkg:npm/ngsw-config

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ngsw-config/MAL-2026-14251.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "5cdc12e39b2025f3bed9324c6b333344ade6b74998da1c21a9d2e5705957f731",
            "path": "postinstall.js",
            "tlsh": "070123d1d2b55a7667b8928068f06f0693bbf323370220b67ac414e93f8e1f900311ac"
        }
    ],
    "package_integrity": [
        {
            "filename": "ngsw-config-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-13M7wRymqcgCF4Rlq5lA42bV/918Lftl3yGAobx62Ti3+QZWM0H9dfPaMdMkQQD/06v6zzDqPiYT7S1P7NpmNw==",
                "sha1": "de64c270d10d2469481a89b998e3272ab2b72d1c"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]