Malicious code in vite-plugin-image-analysis (npm)

The vite-plugin-image-analysis npm package, versions 1.0.0, 1.1.0, and 1.1.2, contains malicious code that injects an inline script into HTML pages during the build process. This script accesses user identity fields such as account, username, userNo, phone, and realName from sessionStorage.userInfo. It hooks the sessionStorage.setItem method to trigger data exfiltration after login events. The stolen data, along with host and OS information, is sent to a remote endpoint whose URL is obfuscated by base64 decoding and XOR with 42 at runtime. The exfiltration uses stealth transports like navigator.sendBeacon and fetch with no-cors and no-referrer policies to evade detection in network monitoring tools. This covert data theft occurs without the knowledge of developers who include this plugin, effectively turning their production sites into PII leak vectors.

End users of websites built with vite-plugin-image-analysis versions 1.0.0, 1.1.0, and 1.1.2 may have sensitive personal information (account identifiers, phone numbers, real names) silently exfiltrated to an attacker-controlled server. This compromises user privacy and can lead to identity theft or further targeted attacks. Developers unknowingly distribute malicious code that breaches user trust and violates data protection principles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal of the malicious package is confirmed, developers should immediately audit their dependencies and remove vite-plugin-image-analysis versions 1.0.0, 1.1.0, and 1.1.2 from their projects. Avoid using this package and verify the integrity of third-party plugins before inclusion. Monitor for updates from the package maintainer or npm security advisories for remediation.