node-config-svg-contractnpm
Advisory published Updated
node-config-svg-contract is a confirmed malicious npm package (MAL-2026-13985) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in node-config-svg-contract (npm)
What this malware does
The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for node-config-svg-contract (version 1.0.0).
If you installed it — respond
Remove node-config-svg-contract from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If node-config-svg-contract was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks node-config-svg-contract-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.