MAL-2026-14211

    Dashboard / Malicious Package / MAL-2026-14211

    MAL-2026-14211

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in sw-pluginer (npm)

    Details: Source: amazon-inspector (38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06) sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config via require('sw-pluginer') — reads a URL from a staged file at node_modules/.bin/manifest.json, performs an HTTP GET to that URL, and passes the response body directly to eval() in the Node build process. The staging file is written by a separate dropper component and is unlinked after being read, hiding the payload destination from static inspection of the sw-pluginer tarball itself. The fetched code is not pinned, hashed, or signature-verified, and it is executed in the developer's Node environment (not in a browser as service worker code) — so whoever controls the staged manifest.json obtains arbitrary code execution on the developer machine at build time. The self-deleting indirection through node_modules/.bin/manifest.json plus eval of unverified network-fetched JavaScript is a covert dropper mechanism, not service worker registration.

    References: https://www.npmjs.com/package/sw-pluginer/v/1.1.0, https://www.npmjs.com/package/sw-pluginer/v/1.0.2, https://www.npmjs.com/package/sw-pluginer/v/1.2.0, https://www.npmjs.com/package/sw-pluginer/v/1.0.1, https://www.npmjs.com/package/sw-pluginer/v/1.0.0

    Affected packages

    Package

    Name: sw-pluginer

    Purl: pkg:npm/sw-pluginer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.0