{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "3a0e1400a7ac8e8b984beef2f330af7a144b04723016ef07681ac0294a725444",
              "tlsh": "767111a8999b7095d6b1e3e447135015f559d1672208c3d4b6acc6983f7172c90f3eec"
            }
          ],
          "package_integrity": [
            {
              "filename": "swift-parse-stream-1.0.2.tgz",
              "hashes": {
                "sha1": "1e113e8a3840e6da087fe3fc63c8937861da7a67",
                "sha512_sri": "sha512-wG0o/vj/OGeoZ7Kh6jbx+mPRzBj5U11KbfaBpOoVj2yrOi5JLEJqK+WxeRF4JTJQKOQxhFfVG78taOjvMLLh8Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "swift-parse-stream"
      },
      "versions": [
        "1.0.2",
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-006905",
        "import_time": "2026-06-17T17:32:18.610311636Z",
        "modified_time": "2026-06-17T16:37:42Z",
        "sha256": "8ab8561c6c561b045d817d4fab3aa0754ce7cd767a3c5ec07b95151dda6b92c8",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-007031",
        "import_time": "2026-06-18T19:20:03.747682205Z",
        "modified_time": "2026-06-18T19:12:19Z",
        "sha256": "62d1882f72b9b1292d6ba9c0f7fad9e1df0b3eb60d3a34f4b2f569223a466480",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8ab8561c6c561b045d817d4fab3aa0754ce7cd767a3c5ec07b95151dda6b92c8)\nswift-parse-stream advertises itself as an SVG sanitizer/minifier but ships an undocumented `getPlugin` export in index.js that, when invoked, performs an HTTP GET against https://www.jsonkeeper.com/b/3P9BF (an anonymous user-paste host) and runs `eval(parsed.model)` on the returned JSON\u0027s `model` field. The destination is attacker-controlled and mutable: whoever controls the paste can change the executed JavaScript at any time without republishing the package. The README does not mention this code path. Any caller \u2014 typically a second compromised package chaining into this one \u2014 that reaches `getPlugin()` hands arbitrary remote code execution to the paste\u0027s owner, running in the consumer application\u0027s process with its full privileges and access to its environment, filesystem, and network.\n",
  "id": "MAL-2026-6068",
  "modified": "2026-06-18T19:21:59Z",
  "published": "2026-06-17T16:37:42Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/swift-parse-stream/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/swift-parse-stream/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in swift-parse-stream (npm)"
}