MalwarePublished 1 Jul 2026Updated 5 Aug 2026

svgson-lite (npm) · Malicious Code

Affects svgson-liteSource GCVE Database

Malicious package : remove svgson-lite and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6707

What to do

Remove svgson-lite from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsvgson-lite	Affected 1.0.0 – 1.0.8 9 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The svgson-lite npm package contains a hidden backdoor in its index.js file. It exports an undocumented getPlugin() function that fetches JavaScript code from a mutable short URL controlled by the package author and executes it via eval(). This behavior is unrelated to the package's stated purpose as an SVG helper and is not documented, indicating deliberate concealment of malicious functionality.

Impact

Any consumer invoking the getPlugin() function in affected versions of svgson-lite risks arbitrary code execution controlled by the package author. This can lead to compromise of the host environment, data theft, or further malicious activity. The malicious code is dynamically fetched from a mutable short URL, enabling the attacker to change payloads at will.

Defensive guidance

Users should avoid using the affected versions of svgson-lite and remove the package from their dependencies. Since the malicious behavior is triggered only by calling the undocumented getPlugin() function, avoiding its use mitigates risk, but full removal is recommended. Monitor vendor advisories for any future fixes.

Summary

The svgson-lite package versions 1.0.0, 1.0.1, 1.0.2, 1.0.4, 1.0.5, 1.0.6, 1.0.7, and 1.0.8 include an undocumented getPlugin() function that performs an HTTP GET request to a short URL controlled by the package author. The response's 'model' field is JSON-parsed and passed directly to eval(), allowing arbitrary code execution in any environment that calls this function. This network fetch and eval behavior is unrelated to SVG processing and is deliberately concealed, representing a backdoor in the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:51 UTC

Technical details

References

Community reviews