MAL-2026-14482
Malicious code in vite-plugin-images-analysis (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388) This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the developer's application. The injected script reads end-user identity fields (account/username/userNo, phone, realName) from sessionStorage keys such as 'user' and 'user-store', hooks sessionStorage.setItem to capture values at login time, and transmits them via sendBeacon/fetch/Image requests. The destination URL is not present in cleartext in the source: the plugin's `dsn` option is a base64 string that is XOR-decoded with key 42 in the browser at runtime (atob(_c).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^42)).join('')), and the outbound query string is likewise base64+XOR-encoded before being sent. The declared 'image analysis' purpose does not match the actual behavior of harvesting logged-in-user PII from the consuming application and posting it to a concealed endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for vite-plugin-images-analysis (npm). Pin to a known-safe version or switch to an alternative.