The svgson-lite package versions 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5, 1.0.6, 1.0.7, and 1.0.8 include an undocumented getPlugin() function that performs an HTTP GET request to a short URL controlled by the package author. The response's 'model' field is JSON-parsed and passed directly to eval(), allowing arbitrary code execution in any environment that calls this function. This network fetch and eval behavior is unrelated to SVG processing and is deliberately concealed, representing a backdoor in the package.

Any consumer invoking the getPlugin() function in affected versions of svgson-lite risks arbitrary code execution controlled by the package author. This can lead to compromise of the host environment, data theft, or further malicious activity. The malicious code is dynamically fetched from a mutable short URL, enabling the attacker to change payloads at will.

No official patch or remediation is currently available. Users should avoid using the affected versions of svgson-lite and remove the package from their dependencies. Since the malicious behavior is triggered only by calling the undocumented getPlugin() function, avoiding its use mitigates risk, but full removal is recommended. Monitor vendor advisories for any future fixes.