vite-plugin-image-analysis

{"modified":"2026-08-25T08:22:33Z","published":"2026-08-25T08:09:38Z","schema_version":"1.7.4","id":"MAL-2026-14480","summary":"Malicious code in vite-plugin-image-analysis (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04)\nThe package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml` hook injects an inline `<script>` into every built HTML page. The injected script reads user identity fields (`account`/`username`/`userNo`, `phone`, `realName`) from `sessionStorage.userInfo`, hooks `sessionStorage.setItem` so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (`atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')`), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — `navigator.sendBeacon`, `fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' })` — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle.\n","affected":[{"package":{"ecosystem":"npm","name":"vite-plugin-image-analysis"},"versions":["1.1.0","1.0.0","1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"4bdce14e80e058993bb0fee538c09aee11d86d3ea0690a4ae679e7074c1e6ff3","tlsh":"bf81657ba463216596a2206b013f443ce3be85031c5ef564b95d9217afcc62c067eff9"}],"package_integrity":[{"filename":"vite-plugin-image-analysis-1.1.0.tgz","hashes":{"sha1":"97d12dc11c60e13eb45622f8028a9eb955e479ea","sha512_sri":"sha512-aMCtJ9R0BY7YVIqInzRYNfqdp9xkUwSwULfi7uQfeXIUC3ta4iuc0NSG6vOtye9kKFk+EFG4hAcxMChINx7x4Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018699","import_time":"2026-08-25T08:20:36.583759673Z","modified_time":"2026-08-25T08:09:53Z","sha256":"8d80c77b7b4e7a90be289a7b97405119318193c25b5429621deeae00f053c77b","source":"amazon-inspector","versions":["1.1.0"]},{"id":"IN-MAL-2026-018698","import_time":"2026-08-25T08:20:36.504157642Z","modified_time":"2026-08-25T08:09:45Z","sha256":"b25366a663127e04d26191faf1726924161eb770ca68f649cc1e7e39f0d3b3d6","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-018697","import_time":"2026-08-25T08:20:36.401473796Z","modified_time":"2026-08-25T08:09:38Z","sha256":"e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04","source":"amazon-inspector","versions":["1.1.2"]}]}}