Malicious code in vite-plugin-image-tracker (npm)

The vite-plugin-image-tracker npm package acts as a malicious plugin by injecting a script into every generated HTML page at build time. This script reads personal identifiable information (PII) such as account, username, user number, phone number, and real name from the browser's sessionStorage. It then constructs a payload with these details, encodes it using XOR with 42 and base64, and sends it to a concealed reporting endpoint. The endpoint address is obfuscated using the same XOR and base64 encoding, preventing easy detection by developers. The package name and description do not reveal this data collection, making it a covert exfiltration tool rather than a legitimate telemetry SDK.

End-user personal data including account identifiers, phone numbers, and real names can be exfiltrated without user or developer knowledge. This compromises user privacy and may lead to identity theft or targeted attacks. The obfuscation of the reporting endpoint and the covert nature of data collection increase the risk of unnoticed data leakage in applications using this package.

No official patch or remediation is currently documented. Users and developers should immediately cease using vite-plugin-image-tracker versions 1.0.0 and 1.1.0. Audit dependencies for this package and remove it from projects. Monitor for any updates or advisories from the package maintainers or security vendors. Since the package is not a cloud service, remediation depends on user action to remove the malicious package.