MAL-2026-14482
Dashboard / Malicious Package / MAL-2026-14482
MAL-2026-14482
Summary: Malicious code in vite-plugin-images-analysis (npm)
Details: Source: amazon-inspector (36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388) This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the developer's application. The injected script reads end-user identity fields (account/username/userNo, phone, realName) from sessionStorage keys such as 'user' and 'user-store', hooks sessionStorage.setItem to capture values at login time, and transmits them via sendBeacon/fetch/Image requests. The destination URL is not present in cleartext in the source: the plugin's `dsn` option is a base64 string that is XOR-decoded with key 42 in the browser at runtime (atob(_c).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^42)).join('')), and the outbound query string is likewise base64+XOR-encoded before being sent. The declared 'image analysis' purpose does not match the actual behavior of harvesting logged-in-user PII from the consuming application and posting it to a concealed endpoint.
Affected packages
Package
Name: vite-plugin-images-analysis
Purl: pkg:npm/vite-plugin-images-analysis
Affected ranges
Type: N/A
Events:
