{"id":"MAL-2026-14480","summary":"Malicious code in vite-plugin-image-analysis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04)\nThe package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml` hook injects an inline `\u003cscript\u003e` into every built HTML page. The injected script reads user identity fields (`account`/`username`/`userNo`, `phone`, `realName`) from `sessionStorage.userInfo`, hooks `sessionStorage.setItem` so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (`atob(_c).split('').map(c =\u003e String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')`), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — `navigator.sendBeacon`, `fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' })` — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle.\n","modified":"2026-08-25T23:50:43.697900779Z","published":"2026-08-25T08:09:38Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-25T08:09:53Z","sha256":"8d80c77b7b4e7a90be289a7b97405119318193c25b5429621deeae00f053c77b","source":"amazon-inspector","versions":["1.1.0"],"id":"IN-MAL-2026-018699","import_time":"2026-08-25T08:20:36.583759673Z"},{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-018698","import_time":"2026-08-25T08:20:36.504157642Z","modified_time":"2026-08-25T08:09:45Z","sha256":"b25366a663127e04d26191faf1726924161eb770ca68f649cc1e7e39f0d3b3d6"},{"id":"IN-MAL-2026-018697","import_time":"2026-08-25T08:20:36.401473796Z","modified_time":"2026-08-25T08:09:38Z","sha256":"e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04","source":"amazon-inspector","versions":["1.1.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.2"}],"affected":[{"package":{"name":"vite-plugin-image-analysis","ecosystem":"npm","purl":"pkg:npm/vite-plugin-image-analysis"},"versions":["1.1.0","1.0.0","1.1.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"vite-plugin-image-analysis-1.1.0.tgz","hashes":{"sha512_sri":"sha512-aMCtJ9R0BY7YVIqInzRYNfqdp9xkUwSwULfi7uQfeXIUC3ta4iuc0NSG6vOtye9kKFk+EFG4hAcxMChINx7x4Q==","sha1":"97d12dc11c60e13eb45622f8028a9eb955e479ea"}}],"evidence_files":[{"tlsh":"bf81657ba463216596a2206b013f443ce3be85031c5ef564b95d9217afcc62c067eff9","path":"index.js","sha256":"4bdce14e80e058993bb0fee538c09aee11d86d3ea0690a4ae679e7074c1e6ff3"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-image-analysis/MAL-2026-14480.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}