Malicious code in node-config-svg-contract (npm)
The npm package node-config-svg-contract contains malicious code that fetches and executes arbitrary JavaScript from a remote endpoint (https://rest-icon-handler.store/icons/) via eval() when its advertised APIs are called. The malicious URL is obfuscated by fragmenting constants to evade casual code review.
- Disclosed
- Last updated
- Blast radius
- Any application that imports and calls the getPlugin, setPlugin, or getPluginExten functions from node-config-svg-contract.
- Ecosystems
- Attack vectors
- Affected entities
- node-config-svg-contractnpm package
The npm package node-config-svg-contract was published with embedded malicious code. The package advertises itself as an SVG/icon CDN helper but contains hidden functionality in its exported functions: getPlugin, setPlugin, and getPluginExten.\n\nWhen these functions are invoked, they construct a URL at runtime from fragmented string constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/. The package then fetches the response body from this attacker-controlled endpoint and passes it directly to eval(JSON.parse(body)), executing arbitrary JavaScript on the caller's host.\n\nThe obfuscation technique—assembling the destination URL from separate string constants rather than using a plain literal—was designed to conceal the malicious endpoint from casual code review. The documented CDN-provider allowlist is not consulted on this execution path.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Domains
- rest-icon-handler.store
Remediation
- Immediately remove node-config-svg-contract from all dependencies and lock files
- Audit all applications that imported this package for unauthorized network connections or code execution
- Review application logs for any calls to getPlugin, setPlugin, or getPluginExten functions
- Regenerate any credentials or secrets that may have been exposed on hosts running affected code
- Update to a safe alternative package for SVG/icon CDN functionality
- Implement runtime monitoring and code review processes to detect obfuscated URL construction patterns
Sources
- GitHub Advisory GHSA-wc9r-p4qf-2qw7 · GitHub Advisory Database
Cite this entry
"Malicious code in node-config-svg-contract (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-node-config-svg-contract-npm-1m3rsf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in banana-stand
The npm package banana-stand contains malware that grants full system compromise to an outside entity. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malware in @siwatfa/yorn
Malware was discovered in the npm package @siwatfa/yorn. Systems with this package installed or running should be considered fully compromised, with all secrets and keys requiring immediate rotation from a different computer.
npmCompromised package - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - activecritical
Malware in rendezvous-js
The npm package rendezvous-js contains malware that grants full control of affected systems. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package