Malicious Code Detected in @smwebserver/static Package - Version 99.9.1
Summary
MAL-2026-17456: Malicious code in @smwebserver/static (npm). Affects @smwebserver/static versions 99.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @smwebserver/static package is a Node.js library used for serving static files in web applications. It is designed to facilitate the delivery of static content efficiently. However, version 99.9.1 has been flagged for malicious behavior, specifically for communicating with a domain linked to harmful activities, raising significant security concerns for users relying on this package.
Vulnerability Detail
The vulnerability in the @smwebserver/static package arises from its version 99.9.1, which has been identified as malicious by the OpenSSF Package Analysis project. The package's malicious nature is attributed to its communication with a domain associated with malicious activities, potentially compromising the security of applications that utilize it. This could lead to data breaches, unauthorized access, or other security incidents, making it critical for users to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @smwebserver/staticIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the @smwebserver/static package from their project until a secure version is confirmed. This can be done by executing the following command: npm uninstall @smwebserver/static.
Conclusion
The @smwebserver/static package version 99.9.1 has been identified as malicious due to its communication with a harmful domain. Users are strongly advised to update or remove the package to mitigate potential security risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for @smwebserver/static →
FAQ
The package has been found to communicate with a domain that is linked to malicious activities, which poses a risk to applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your package-lock.json file or use the Vulert playground at Vulert Scanner to check for vulnerabilities without signing up.
If an immediate update is not possible, consider removing the package from your project as a temporary measure until a secure version is available.
While specific exploits have not been detailed, the communication with a malicious domain indicates a potential for data breaches or unauthorized access.
Regularly check security advisories for your dependencies, and consider using tools like Vulert to monitor your projects for vulnerabilities.
