MAL-2026-16211

    Dashboard / Malicious Package / MAL-2026-16211

    MAL-2026-16211

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in swnwall (npm)

    Details: Source: amazon-inspector (70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a) On require/import, index.js invokes initialize() which spawns loader.js as a detached, hidden background child process (detached: true, windowsHide: true, stdio: 'ignore', unref'd) and records a.pid file to avoid re-spawning. loader.js performs an HTTPS GET against https://api.npoint.io/641d37178a880b1e8b8f (a user-editable JSON hosting service), base64-decodes the `code` field of the response, and executes the decoded payload via `new Function("require",..., decodedCode)(require, __dirname, __filename,...)`, granting the fetched code full access to Node's require, filesystem, and process APIs on the installer's machine. loader.js additionally monkey-patches Module.prototype.require to force windowsHide on all child_process spawn calls and reroute execSync through a hidden `cmd.exe /c`, concealing further child-process activity. The remote payload is mutable and attacker-controllable via the npoint.io endpoint.

    References: https://www.npmjs.com/package/swnwall/v/1.2.10

    Affected packages

    Package

    Name: swnwall

    Purl: pkg:npm/swnwall

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.10