MAL-2026-14486

    Dashboard / Malicious Package / MAL-2026-14486

    MAL-2026-14486

    Published: 25 Aug 2026Last Modified: 25 Aug 2026

    Summary: Malicious code in spf-analytics (npm)

    Details: Source: amazon-inspector (8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77) index.js is a heavily obfuscated browser script (obfuscator.io-style string-array + rotation) advertised for inclusion via unpkg on Shopify-style storefronts. At runtime it listens for the 'gokwik_events' window event and harvests customer name, phone, email, full address, city, state, country, pincode, cart line items, order total, and payment method. The captured PII is encrypted with a hardcoded RSA-OAEP public key wrapping an AES-GCM session key and POSTed to https://connector.internalwebhooks.com/spf-analytics, a destination the storefront operator did not configure. A localStorage key ('shopify_analytics_cache_7f4c91d8b2e64a0f9c37d5ab81e26f43') holds up to 500 fingerprints to suppress duplicate uploads, and a __spfAddressForwarderLoaded flag guards against double-loading. The endpoint URL, PEM key, event name, and field names are all indirected through the obfuscator string table, concealing the destination and captured fields from casual inspection of the CDN-served bundle. The package presents itself as 'analytics' but the relay is to a non-first-party endpoint hardcoded by the author, encrypted to prevent network inspection, and never disclosed to the operator embedding the script.

    References: https://www.npmjs.com/package/spf-analytics/v/1.0.0

    Affected packages

    Package

    Name: spf-analytics

    Purl: pkg:npm/spf-analytics

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0