MAL-2026-13985

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1) The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.