swnwall

{"modified":"2026-09-16T06:28:43Z","published":"2026-09-16T06:28:43Z","schema_version":"1.7.4","id":"MAL-2026-16211","summary":"Malicious code in swnwall (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a)\nOn require/import, index.js invokes initialize() which spawns loader.js as a detached, hidden background child process (detached: true, windowsHide: true, stdio: 'ignore', unref'd) and records a.pid file to avoid re-spawning. loader.js performs an HTTPS GET against https://api.npoint.io/641d37178a880b1e8b8f (a user-editable JSON hosting service), base64-decodes the `code` field of the response, and executes the decoded payload via `new Function(\"require\",..., decodedCode)(require, __dirname, __filename,...)`, granting the fetched code full access to Node's require, filesystem, and process APIs on the installer's machine. loader.js additionally monkey-patches Module.prototype.require to force windowsHide on all child_process spawn calls and reroute execSync through a hidden `cmd.exe /c`, concealing further child-process activity. The remote payload is mutable and attacker-controllable via the npoint.io endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"swnwall"},"versions":["1.2.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"loader.js","sha256":"98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4","tlsh":"d35143a609fb35120277b0e6b70b596a96bba113314ec994fa9cc3d44fc2421d3d32dc"},{"path":"init.js","sha256":"dfd17877122c08d4206e82fb3b58793f4063f4005cfdd7805b325be2293d5822","tlsh":"f32142ab286a4b3981b2c4aa471fc51013a7d1777254f9a9f4ce87b56f0661cca238c8"}],"package_integrity":[{"filename":"swnwall-1.2.10.tgz","hashes":{"sha1":"1f94ae5929d19fdb0a885660afac4d77c2b6e030","sha512_sri":"sha512-5WeY7G2ZwyZQBaLBcEBHlcUomUlOd5ss6SazXbjbSA2Fiap4LLjEtwyjsYAkakAAZRdQqaGqVtHeI2LlrPCiiQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/swnwall/v/1.2.10"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020075","import_time":"2026-09-16T06:31:14.606334497Z","modified_time":"2026-09-16T06:28:43Z","sha256":"70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a","source":"amazon-inspector","versions":["1.2.10"]}]}}