{"id":"MAL-2026-11065","summary":"Malicious code in swiper_angular (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5)\nPackage name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer host identity and network context — os.hostname(), os.userInfo() username, current working directory, package name, git remote domain, /etc/resolv.conf search domain, /etc/hosts and /etc/hostname content grepped for 'tbi|beez|tbibank', egress IP via `ip route get 1.1.1.1` and `curl -s ifconfig.me`, and environment variable names filtered against the same organization tokens. The collected fields are concatenated into a query string and sent via https.get to the hardcoded Interactsh subdomain rmknhtfmmidejheotogony3qpqrk75wdz.oast.fun/cb2. Behavior fires automatically on npm install with no consent prompt and targets a specific organization (tbibank) regardless of the self-applied 'security research' label.\n\n## Source: ossf-package-analysis (474db4780bfc49ff2146966bdd508c123baf4d39c636e27aaba1996a0016d8f6)\nThe OpenSSF Package Analysis project identified 'swiper_angular' @ 5.9999.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-05T13:36:13.154219192Z","published":"2026-07-25T16:30:40Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-25T16:30:40Z","sha256":"474db4780bfc49ff2146966bdd508c123baf4d39c636e27aaba1996a0016d8f6","source":"ossf-package-analysis","versions":["5.9999.0"],"import_time":"2026-07-25T16:51:35.076077101Z"},{"import_time":"2026-08-04T22:30:06.82843551Z","modified_time":"2026-08-04T21:53:02Z","sha256":"af00e41bdc43d8aa468c73cbb63251cd85bbf40dd3cd0d57f38abeee77dc2559","source":"amazon-inspector","versions":["5.9999.0"],"id":"IN-MAL-2026-011243"},{"source":"amazon-inspector","versions":["5.9999.1"],"id":"IN-MAL-2026-014839","import_time":"2026-08-05T13:08:50.336465716Z","modified_time":"2026-08-05T12:59:44Z","sha256":"35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/swiper_angular/v/5.9999.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/swiper_angular/v/5.9999.1"}],"affected":[{"package":{"name":"swiper_angular","ecosystem":"npm","purl":"pkg:npm/swiper_angular"},"versions":["5.9999.0","5.9999.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-m/pOQBB0cwlYaltcwgPiJ8YxeZn2Cagly71R/1ejWtv36tkUJrWtFNwdJYidO/M9sUDym44LwcHBwuny8uX5Zg==","sha1":"9243a487c5796685899070c5e6cd7b5a6725798f"},"filename":"swiper_angular-5.9999.0.tgz"}],"evidence_files":[{"tlsh":"640190b605f4413028d9a2d8a32bb65fd4daf5514c5a4f84f99d42409b6216a26134f1","path":"preinstall.js","sha256":"1f2a201d4233343e6ca207ce4cbea9ffffb3c58a0fe9a7c49ffeea8678759a28"},{"sha256":"d5693ae726b1c2e28739afccd1401e5eeeb38ecd75baa2dafdee6c69569efd8a","tlsh":"81e020208f94683314c8d6662d73861a75a74f3e9155b90ca7c71405c3bf771c0bfa5e","path":"package.json"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/swiper_angular/MAL-2026-11065.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}