{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/index.cjs",
              "sha256": "81459e0c5668e3003f757a40aa97298f2b038a1c11116a078a4df7c55460c4bf",
              "tlsh": "650293287cf364920b63709d45cb90ac34b6e507345bde50aa6c49012fa83ace1f7bbd"
            }
          ],
          "package_integrity": [
            {
              "filename": "svgcraft-core-1.0.1.tgz",
              "hashes": {
                "sha1": "09180763fb0685307b86813631688d798d2f6286",
                "sha512_sri": "sha512-56b0w1Q/C5DqzyYbwZo4Rz6wTZ33FgjucWjQOi0g/CRAS6lLn+omUdVYZL5WDwszpZ0pXMVcLBpiGkEgL2sb9A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "svgcraft-core"
      },
      "versions": [
        "1.0.1",
        "1.0.2",
        "1.0.4",
        "1.0.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007900",
        "import_time": "2026-07-01T21:04:20.940834484Z",
        "modified_time": "2026-07-01T20:48:15Z",
        "sha256": "1407a3b83a7eff7ec054312944ce4bf2c39fc1a26d9c16cda9f7c3c4afa72187",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007904",
        "import_time": "2026-07-01T21:04:21.214869201Z",
        "modified_time": "2026-07-01T20:48:49Z",
        "sha256": "3d44028203c0771b7e6d77ac8addb4d100be6e75992c7ef0bd066035aba86d31",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-007901",
        "import_time": "2026-07-01T21:04:21.007200975Z",
        "modified_time": "2026-07-01T20:48:25Z",
        "sha256": "5207167735bdb696743300e61746560ce445beb11da6005ebf7710b7be3408f2",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      },
      {
        "id": "IN-MAL-2026-007903",
        "import_time": "2026-07-01T21:04:21.126557338Z",
        "modified_time": "2026-07-01T20:48:42Z",
        "sha256": "a18879a0b6e0246f4c05a677423bbb9a6aaf8c533467937236288c41e42ef011",
        "source": "amazon-inspector",
        "versions": [
          "1.0.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3d44028203c0771b7e6d77ac8addb4d100be6e75992c7ef0bd066035aba86d31)\nThe CommonJS entry point exports an undocumented `getPlugin()` factory that fetches a URL-shortener target (https://shorturl.at/nkw3a) and passes a JSON field from the response to `eval`, executing attacker-controlled JavaScript inside the caller\u0027s Node.js process. The shortener destination is mutable, so the operator can swap the executed payload at any time without republishing the package. Additional concealment signals: the function uses cover-story field names (`bearrtoken: \u0027logo\u0027`, `parsed.cookie` guarding `eval(parsed.model)`); the backdoor exists only in the CommonJS build (the ESM entry omits it); the file `require`s an undeclared `request` dependency; and the README advertises \u0027zero dependencies\u0027 and does not mention this behavior. Any consumer invoking `getPlugin()()` via the CJS build will execute remote code chosen by whoever controls the shortener.\n",
  "id": "MAL-2026-6715",
  "modified": "2026-07-01T21:06:12Z",
  "published": "2026-07-01T20:48:15Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/svgcraft-core/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/svgcraft-core/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/svgcraft-core/v/1.0.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/svgcraft-core/v/1.0.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in svgcraft-core (npm)"
}