LWA-2026-13109 confirmed malware

swytchcode@2.24.3

Malicious code in swytchcode (npm)

Analysis

swytchcode@2.24.3 is an npm launcher package for the Swytchcode API-integration CLI. The tarball contains only a JavaScript wrapper and an install hook; the executable logic is delivered separately as six platform-specific native binaries in the optional dependencies swytchcode-cli-linux-x64, swytchcode-cli-linux-arm64, swytchcode-cli-darwin-x64, swytchcode-cli-darwin-arm64, swytchcode-cli-win32-x64 and swytchcode-cli-win32-arm64 at the same version. bin/swytchcode.js resolves the matching binary and spawns it with the full inherited process environment, and its only network destination is hxxps://api-v2[.]swytchcode[.]com/v3/cli. The wrapper also reads SWYTCHCODE_TOKEN, a SWYTCHCODE_TOKEN entry in ./.env, and ~/.swytchcode/auth.json to determine sign-in state. The postinstall hook (scripts/postinstall.js) runs only on Windows global installs and deletes the npm-generated swytchcode.ps1 and swy.ps1 shims from the npm global prefix so PowerShell falls back to the .cmd wrapper. The behaviour of the platform binaries themselves is not contained in this package and is not described here.

analyzed by
Leitwacht
first seen
Oct 20, 2026, 05:54 AM
analyzed
Oct 20, 2026, 11:34 AM
weekly installs
267

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.