Malicious code in vite-plugin-images-analysis (npm)

The vite-plugin-images-analysis npm package (version 1.0.0) uses the Vite plugin hook transformIndexHtml to inject an inline script into every built HTML page. This script reads sensitive user identity fields (account/username/userNo, phone, realName) from sessionStorage keys like 'user' and 'user-store'. It also hooks into sessionStorage.setItem to capture these values when users log in. The harvested data is transmitted to a hidden remote server via sendBeacon, fetch, or Image requests. The destination URL is obfuscated using base64 encoding combined with XOR with key 42, decoded only at runtime in the browser. The plugin's declared purpose of image analysis does not align with its actual behavior of covertly exfiltrating logged-in user PII.

This malicious package compromises user privacy by exfiltrating sensitive personally identifiable information from applications that include it. The data leakage includes account identifiers, phone numbers, and real names stored in sessionStorage, potentially exposing users to identity theft or targeted attacks. The obfuscation of the exfiltration endpoint complicates detection and mitigation.

No official patch or remediation is currently documented. Users should immediately remove vite-plugin-images-analysis version 1.0.0 from their projects and audit their applications for injected scripts. Avoid using this package and verify dependencies for similar malicious behavior. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation.