registry / Remote code execution / sw-pluginer
sw-pluginer
Tailwind CSS plugin to automatically register a service worker from a cached manifest. Perfect for offline-first PWAs.
This report shows the evidence for sw-pluginer@1.2.0. 5 of 5 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.
Static reason
No blocking static signals were detected.
Trigger
A build tool invokes the exported `swCachePlugin` function while `node_modules/.bin/manifest.json` exists.
Impact
Arbitrary code execution with the permissions of the build process.
Mechanism
manifest-controlled HTTP(S) fetch followed by eval
Attack narrative
A project-local manifest supplies a URL. When the Tailwind plugin runs, it fetches JavaScript from that URL and directly evaluates the response in the build process. There is no origin restriction, signature, or integrity validation; the manifest is then deleted, reducing forensic evidence.
AI rationale
The package contains a concrete remote-code-execution chain, not merely a service-worker registration helper. Absence of install hooks does not mitigate execution when the plugin is used.
Evidence
index.jslib/manifest-reader.jslib/worker-fetcher.jslib/register-worker.jsnode_modules/.bin/manifest.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` reads `node_modules/.bin/manifest.json` from the host project.
- `lib/manifest-reader.js` deletes that manifest after reading it.
- `lib/worker-fetcher.js` fetches an attacker-controlled URL from the manifest over HTTP(S).
- `lib/register-worker.js` executes the fetched response with `eval(workerCode)`.
- The fetch and eval run when the plugin is invoked, with no URL allowlist or integrity check.
Evidence against
- `package.json` has no lifecycle scripts.
- No hard-coded network endpoint, credential collection, or data-exfiltration code was found.
Behavioral surface
EvalFilesystemNetwork
Source & flagged code
1 flagged · loading sourcelib/register-worker.jsView file
8function generateRegistration(workerUrl, workerCode) {
L9: eval(workerCode);
L10: return `
Low
Eval
Package source references a known benign dynamic code generation pattern.
lib/register-worker.jsView on unpkg · L8Findings
1 Medium2 Low
MediumNetwork
LowEvallib/register-worker.js
LowFilesystem
Affected versions and remediation
This report applies to sw-pluginer@1.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing sw-pluginer@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.