capacitor-plugin-service-worker@100.0.0: Malicious npm security

OSV Malicious Advisory

scanned 21d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-3327 confirms this npm version as malicious. The package capacitor-plugin-service-worker was found to contain malicious code.

Advisory

MAL-2026-3327

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in capacitor-plugin-service-worker (npm)

Details

The package capacitor-plugin-service-worker was found to contain malicious code. ## Source: ossf-package-analysis (3f28ba8fd7638915ed1060990ac5bbe779c131ee7453a155248a2f5d9d8c8e53) The OpenSSF Package Analysis project identified 'capacitor-plugin-service-worker' @ 100.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 453 B of source

Source & flagged code

1 flagged

package.jsonView file

Lines 1-13json

1{

2 "name": "capacitor-plugin-service-worker",

3 "version": "100.0.0",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

7 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

9 "keywords": [],

10 "author": "",

11 "license": "ISC"

12}

13

OSV Malicious Advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code