npm · Malicious package advisory
Malwarecapacitor-plugin-service-worker
MAL-2026-3327
Malicious code in capacitor-plugin-service-worker (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36f1958d8bc44724a00d45b291983ad836dc2f28370c27f83c76f7bf1780bd4b) The package capacitor-plugin-service-worker was found to contain malicious code. ## Source: ossf-package-analysis (3f28ba8fd7638915ed1060990ac5bbe779c131ee7453a155248a2f5d9d8c8e53) The OpenSSF Package Analysis project identified 'capacitor-plugin-service-worker' @ 100.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.
Compromised versions (2)
- 100.0.0
- 100.2.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.