The maplibre-gl-vue3 npm package (version 1.0.0) advertises itself as Vue 3 bindings for MapLibre GL but includes malicious behavior by unconditionally injecting a <script> tag pointing to a hardcoded HTTP endpoint (http://121.199.166.250:19527/myApi/pipesnetwork.js) into the document head upon import. This endpoint serves attacker-controlled JavaScript, enabling full access to browser-stored sensitive data within the host application. The script loader is unpinned, served over plaintext HTTP, and unrelated to the package's stated mapping functionality. A source comment suggests the script URL was intended to be replaced before release, indicating this is likely a supply chain compromise. The package name shadows the legitimate vue-maplibre-gl package, increasing the likelihood of accidental usage.

Any Vue 3 application importing maplibre-gl-vue3 version 1.0.0 will execute attacker-controlled JavaScript in the browser context, potentially exposing cookies, localStorage, session tokens, and user input to the attacker. This compromises user data confidentiality and application integrity. The use of an unencrypted HTTP endpoint allows for interception and modification of the malicious script in transit.

No official patch or remediation is currently available for maplibre-gl-vue3 version 1.0.0. Users should avoid installing or using this package. Instead, use the legitimate vue-maplibre-gl package for Vue 3 bindings to MapLibre GL. Monitor vendor advisories for updates or official fixes. Since this is a malicious package, removing it from projects and dependency trees is critical.