Malicious code in ngsw-config (npm)

The malicious npm package 'ngsw-config' version 1.0.0 executes a postinstall script that gathers system and environment metadata from the installer host and transmits it as JSON to a hardcoded URL (https://wxc97jnc.instances.poc.jchunt.top/ngsw-config). This behavior occurs without user consent or documentation. The package name is crafted to shadow Angular's legitimate 'ngsw-config' tool, serving as a canary for dependency confusion attacks where internal build systems mistakenly resolve this malicious package and leak sensitive identifying information to the attacker-controlled endpoint.

The primary impact is unauthorized data exfiltration of host identifiers and environment details during package installation. This can lead to privacy violations and potential reconnaissance by attackers. There is no indication of further exploitation or code execution beyond data collection. No known exploits in the wild have been reported.

No official patch or remediation is currently available. Users should avoid installing the 'ngsw-config' package version 1.0.0 from untrusted sources. Verify package authenticity and source before installation, especially in internal build systems. Monitor dependency resolution configurations to prevent dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.