MAL-2026-14480

Dashboard / Malicious Package / MAL-2026-14480

MAL-2026-14480

Summary: Malicious code in vite-plugin-image-analysis (npm)

Details: Source: amazon-inspector (e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04) The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml` hook injects an inline `<script>` into every built HTML page. The injected script reads user identity fields (`account`/`username`/`userNo`, `phone`, `realName`) from `sessionStorage.userInfo`, hooks `sessionStorage.setItem` so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (`atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')`), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — `navigator.sendBeacon`, `fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' })` — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle.

References: https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.0, https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.0.0, https://www.npmjs.com/package/vite-plugin-image-analysis/v/1.1.2