The vite-svg-parse package (version 1.1.3) exports API functions getPlugin and setPlugin that decode two base64-encoded strings at runtime. The first string decodes to a shell command that installs the npm package node-internal-svg-loader without saving it to dependencies and suppresses output and audits. The second string decodes to the module name node-internal-svg-loader, which is then required and invoked. This undeclared dependency is hidden from static analysis by encoding the command and module name in base64. Any consumer calling the documented API triggers the installation and execution of this hidden package within the Node.js process, leading to execution of potentially malicious code.

Any user or system that imports vite-svg-parse version 1.1.3 and calls its documented API will unknowingly execute a hidden shell command that installs and runs an undeclared third-party package. This results in arbitrary code execution within the Node.js process, which can compromise the integrity and security of the environment where the package is used.

No official patch or remediation is currently documented. Users should avoid using vite-svg-parse version 1.1.3. Review and audit dependencies carefully before use. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.