MAL-2026-13985

    Dashboard / Malicious Package / MAL-2026-13985

    MAL-2026-13985

    Published: 13 Aug 2026Last Modified: 13 Aug 2026

    Summary: Malicious code in node-config-svg-contract (npm)

    Details: Source: amazon-inspector (f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1) The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.

    References: https://www.npmjs.com/package/node-config-svg-contract/v/1.0.0

    Affected packages

    Package

    Name: node-config-svg-contract

    Purl: pkg:npm/node-config-svg-contract

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0