MAL-2026-14211

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06) sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config via require('sw-pluginer') — reads a URL from a staged file at node_modules/.bin/manifest.json, performs an HTTP GET to that URL, and passes the response body directly to eval() in the Node build process. The staging file is written by a separate dropper component and is unlinked after being read, hiding the payload destination from static inspection of the sw-pluginer tarball itself. The fetched code is not pinned, hashed, or signature-verified, and it is executed in the developer's Node environment (not in a browser as service worker code) — so whoever controls the staged manifest.json obtains arbitrary code execution on the developer machine at build time. The self-deleting indirection through node_modules/.bin/manifest.json plus eval of unverified network-fetched JavaScript is a covert dropper mechanism, not service worker registration.