Malicious code in vite-plugin-bug-tracker (npm)

The vite-plugin-bug-tracker npm package versions 1.0.0 and 1.1.0 include a malicious transformIndexHtml hook that injects an inline script into all built HTML pages. This script reads sensitive user data from sessionStorage fields like account/username, phone number, and real name. It exfiltrates this data via fetch (no-cors), sendBeacon, or Image requests to a runtime-decoded and XOR-obfuscated URL, preventing easy detection by static or network inspection. Additionally, the plugin monkey-patches sessionStorage.setItem to trigger data exfiltration whenever matching keys are written. This behavior effectively turns any application built with this plugin into a PII harvesting tool without developer or user awareness.

Applications built using vite-plugin-bug-tracker versions 1.0.0 and 1.1.0 expose end users to privacy violations by leaking personally identifiable information stored in sessionStorage. The exfiltration is stealthy due to runtime URL obfuscation and multiple transmission methods, making detection difficult. This compromises user privacy and may violate data protection regulations depending on jurisdiction.

No official patch or remediation guidance is provided in the source data. Users and developers should immediately remove vite-plugin-bug-tracker versions 1.0.0 and 1.1.0 from their projects and avoid using this package. Review and audit dependencies for malicious code before inclusion. Monitor for updates or advisories from the package maintainers or security communities for any official fixes.