What does swiper_angular 5.9999.1 do at install time?

Q: What does swiper_angular 5.9999.1 do at install time?

Protet's sandbox detonated swiper_angular 5.9999.1 (npm) and recorded behaviour worth knowing about at install time. Protet does NOT classify this package as malicious — the observations describe what it did, not an assessment of intent.

← All analysed packages

npm package

swiper_angular

version 5.9999.1 · detonated 2026-07-26 · isolated sandbox

◆ Notable behaviour — not classified as malicious

Context: Its README declares this a canary registered by a security researcher participating in the affected vendor's published bug-bounty programme, and Protet detected the behaviour below from sandbox execution alone, independently of that disclosure. On install it beacons host identity to an out-of-band collector over HTTPS: hostname, username, working directory, git remote domain, DNS search domain, egress IP, and environment variable NAMES. Protet had planted 15 credentials in the sandbox environment and none of them left the box, which matches the probe's own stated scope of names-never-values.

Suspicious command chain

node preinstall.js || true

grep -h '^search\\|^domain' /etc/resolv.conf | head -1 | awk '{print $2}'

grep -h ^search\\|^domain /etc/resolv.conf

esbuild --version

vite build

What it did

Resolved 3 domain(s) during install.
ifconfig.meregistry.npmjs.orgrmknhtfmmidejheotogony3qpqrk75wdz.oast.fun
Read 3 sensitive path(s).
/etc/passwd/home/det/.npmrc/tmp/detonate.GEgOX6/.npmrc

Protet continuously detonates newly-published npm packages in an isolated sandbox and records what they actually do at install and run time. The observations above are things an install was not asked to perform — they are reported so you can decide whether you expected them. swiper_angular 5.9999.1 is not classified as malicious, and many packages behave this way for entirely legitimate reasons. Browse every package we've analysed.