Malicious code in vite-plugin-images-analysis (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388) This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the developer's application. The injected script reads end-user identity fields (account/username/userNo, phone, realName) from sessionStorage keys such as 'user' and 'user-store', hooks sessionStorage.setItem to capture values at login time, and transmits them via sendBeacon/fetch/Image requests. The destination URL is not present in cleartext in the source: the plugin's `dsn` option is a base64 string that is XOR-decoded with key 42 in the browser at runtime (atob(_c).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^42)).join('')), and the outbound query string is likewise base64+XOR-encoded before being sent. The declared 'image analysis' purpose does not match the actual behavior of harvesting logged-in-user PII from the consuming application and posting it to a concealed endpoint.
Malicious code in vite-plugin-images-analysis (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388) This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the developer's application. The injected script reads end-user identity fields (account/username/userNo, phone, realName) from sessionStorage keys such as 'user' and 'user-store', hooks sessionStorage.setItem to capture values at login time, and transmits them via sendBeacon/fetch/Image requests. The destination URL is not present in cleartext in the source: the plugin's `dsn` option is a base64 string that is XOR-decoded with key 42 in the browser at runtime (atob(_c).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^42)).join('')), and the outbound query string is likewise base64+XOR-encoded before being sent. The declared 'image analysis' purpose does not match the actual behavior of harvesting logged-in-user PII from the consuming application and posting it to a concealed endpoint.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14482
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8d9ae8acd9273b493e1795
Added to database: 08/25/2026, 13:38:48 UTC
Last updated: 08/25/2026, 14:52:50 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.