Malicious code in nativescript-swisspost-pcc-creative-editor (npm)
The npm package 'nativescript-swisspost-pcc-creative-editor' version 54.16.3 is a malicious package masquerading as an internal Swiss Post NativeScript package. It executes arbitrary Node.js code during installation by running a script that leaks the installer's project directory name to a third-party URL. This package represents a dependency confusion attack, leading to code execution and information disclosure on the installer's system. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated. Removal of the package alone may not fully remediate the compromise.
AI Analysis
Technical Summary
The 'nativescript-swisspost-pcc-creative-editor' npm package (version 54.16.3) contains malicious code executed during the npm install process via a 'preinstall' script. This script reads the installer's project directory name and sends it to a hardcoded external callback URL, leaking sensitive information. The package is a dependency confusion attack, masquerading as an internal Swiss Post package but executing arbitrary code on the installer's machine. The compromise includes both code execution and information disclosure, potentially allowing attackers full control over affected systems.
Potential Impact
Installation of this package results in arbitrary code execution on the installer's machine and disclosure of the installer's project directory name to an external attacker-controlled server. This leads to a full system compromise, risking exposure of secrets, keys, and other sensitive data stored on the affected computer. The attacker may maintain persistent access beyond the package removal.
Mitigation Recommendations
No official patch or fix is available. Immediate removal of the package is recommended. Due to the severity of the compromise, all secrets and keys stored on affected systems should be rotated from a separate, uncompromised device. Consider the affected systems fully compromised and perform thorough incident response and forensic analysis. Avoid installing packages from untrusted or suspicious sources, especially those mimicking internal or proprietary packages.
Malicious code in nativescript-swisspost-pcc-creative-editor (npm)
Description
The npm package 'nativescript-swisspost-pcc-creative-editor' version 54.16.3 is a malicious package masquerading as an internal Swiss Post NativeScript package. It executes arbitrary Node.js code during installation by running a script that leaks the installer's project directory name to a third-party URL. This package represents a dependency confusion attack, leading to code execution and information disclosure on the installer's system. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated. Removal of the package alone may not fully remediate the compromise.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'nativescript-swisspost-pcc-creative-editor' npm package (version 54.16.3) contains malicious code executed during the npm install process via a 'preinstall' script. This script reads the installer's project directory name and sends it to a hardcoded external callback URL, leaking sensitive information. The package is a dependency confusion attack, masquerading as an internal Swiss Post package but executing arbitrary code on the installer's machine. The compromise includes both code execution and information disclosure, potentially allowing attackers full control over affected systems.
Potential Impact
Installation of this package results in arbitrary code execution on the installer's machine and disclosure of the installer's project directory name to an external attacker-controlled server. This leads to a full system compromise, risking exposure of secrets, keys, and other sensitive data stored on the affected computer. The attacker may maintain persistent access beyond the package removal.
Mitigation Recommendations
No official patch or fix is available. Immediate removal of the package is recommended. Due to the severity of the compromise, all secrets and keys stored on affected systems should be rotated from a separate, uncompromised device. Consider the affected systems fully compromised and perform thorough incident response and forensic analysis. Avoid installing packages from untrusted or suspicious sources, especially those mimicking internal or proprietary packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5793
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-h5g9-q449-jr2c"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a577eea68715ace43b41295
Added to database: 07/15/2026, 12:36:58 UTC
Last enriched: 07/15/2026, 12:54:09 UTC
Last updated: 07/25/2026, 07:50:39 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.