The maplibre-gl-vue3 npm package (version 1.0.0) masquerades as Vue 3 bindings for MapLibre GL but unconditionally injects a <script> tag pointing to a hardcoded HTTP URL (http://121.199.166.250:19527/myApi/pipesnetwork.js) into the document head upon import. This script is attacker-controlled and fetched without integrity verification or encryption, enabling remote code execution in the browser context of the host application. The malicious behavior is embedded in the module's top-level code, and a source comment suggests the script URL was intended to be replaced before release, indicating the loader is designed to deliver third-party code. The package name shadows the legitimate vue-maplibre-gl package, increasing the likelihood of inadvertent use.

Any Vue 3 application importing [email protected] will execute attacker-controlled JavaScript in the user's browser, potentially compromising cookies, localStorage, session tokens, and user inputs. This can lead to user session hijacking, data theft, and further client-side compromise. The use of an unencrypted HTTP endpoint without subresource integrity allows tampering and interception of the malicious script during transit.

No official patch or remediation is currently available for [email protected]. Users should immediately avoid installing or importing this package. Replace any usage of maplibre-gl-vue3 with the legitimate vue-maplibre-gl package or other trusted alternatives. Monitor dependencies for supply chain risks and verify package authenticity before installation. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.