Malicious code in sw-pluginer (npm)

sw-pluginer is a malicious npm package that pretends to be a Tailwind plugin for service worker registration. Its main export reads a URL from a staged manifest.json file located at node_modules/.bin/, which is written by a separate dropper component and deleted after use. It performs an HTTP GET request to the URL and directly executes the response body using eval() in the Node.js environment during the build process. The fetched code is neither pinned, hashed, nor signature-verified, allowing an attacker controlling the manifest.json URL to achieve arbitrary code execution on the developer's machine. The use of a self-deleting manifest file and eval of untrusted network code constitutes a covert dropper mechanism rather than legitimate service worker registration functionality.

An attacker who controls the URL in the staged manifest.json can execute arbitrary code on the developer's machine at build time. This leads to a full compromise of the development environment, potentially allowing theft of credentials, insertion of further malicious code, or disruption of the build process. Because the malicious code runs in the Node.js environment, it has the same privileges as the developer running the build.

No official patch or remediation is currently documented. Users should immediately remove sw-pluginer from their dependencies and avoid installing or running builds that include this package. Verify all dependencies for authenticity and integrity before use. Since the malicious behavior relies on a staged manifest.json file and network-fetched code, monitoring for unexpected files in node_modules/.bin and network activity during builds may help detect exploitation attempts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.