Threats Tagged 'mal-2026-14480'
View all threats tagged with 'mal-2026-14480'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-14480'
Click on any threat for detailed analysis and mitigation recommendations
Malicious code in vite-plugin-image-analysis (npm) 0 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04) The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its `transformIndexHtml` hook injects an inline `<script>` into every built HTML page. The injected script reads user identity fields (`account`/`username`/`userNo`, `phone`, `realName`) from `sessionStorage.userInfo`, hooks `sessionStorage.setItem` so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (`atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')`), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — `navigator.sendBeacon`, `fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' })` — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle. Join the discussion | GCVE Database | 08/25/2026, 08:09:38 UTC Added: 08/25/2026, 13:38:47 UTC |
Showing 1 to 1 of 1 result