Malicious code in swiper_angular (npm)
Affects swiper_angularSource GCVE Database
Rated by Threat Radar
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmswiper_angular | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should avoid installing the 'swiper_angular' package version 5.9999.0. Verify package authenticity before installation and prefer official, verified package sources. Monitor for updates from the package maintainers or security advisories for remediation. Since this is not a cloud service, remediation depends on user action to avoid or remove the malicious package.
Description
The npm package 'swiper_angular' version 5.9999.0 is identified as malicious due to embedded code that executes automatically during installation. This code collects detailed host and network information, including hostname, user info, working directory, package and git details, DNS and hosts file contents, and external IP addresses. The collected data is sent to a hardcoded external domain associated with malicious activity. The behavior targets a specific organization (tbibank) without user consent. No official patch or remediation guidance is currently available.
Summary
The 'swiper_angular' npm package at version 5.9999.0 contains a preinstall.js script that runs automatically upon installation. This script gathers extensive environment and network information from the host system, including OS hostname, user information, current directory, package name, git remote domain, DNS resolver configurations, hosts file contents filtered for specific organization tokens, and external IP addresses. The collected data is concatenated into a query string and exfiltrated via HTTPS GET request to a hardcoded Interactsh subdomain known for malicious activity. This behavior is triggered without user consent and specifically targets the organization 'tbibank'. The package is classified as malicious by the OpenSSF Package Analysis project and Amazon Inspector. There is no CVSS score or vendor advisory available, and no known exploits in the wild have been reported.
Impact
The malicious code compromises user privacy and security by exfiltrating sensitive host and network information to an attacker-controlled domain. This can lead to targeted reconnaissance against the affected organization (tbibank), potentially facilitating further attacks. The automatic execution during package installation increases the risk of unnoticed data leakage. No direct code execution or system compromise beyond data exfiltration is described.
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.