Threats Tagged 'mal-2026-14482'
View all threats tagged with 'mal-2026-14482'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-14482'
Click on any threat for detailed analysis and mitigation recommendations
Malicious code in vite-plugin-images-analysis (npm) 0 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388) This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the developer's application. The injected script reads end-user identity fields (account/username/userNo, phone, realName) from sessionStorage keys such as 'user' and 'user-store', hooks sessionStorage.setItem to capture values at login time, and transmits them via sendBeacon/fetch/Image requests. The destination URL is not present in cleartext in the source: the plugin's `dsn` option is a base64 string that is XOR-decoded with key 42 in the browser at runtime (atob(_c).split('').map(c=>String.fromCharCode(c.charCodeAt(0)^42)).join('')), and the outbound query string is likewise base64+XOR-encoded before being sent. The declared 'image analysis' purpose does not match the actual behavior of harvesting logged-in-user PII from the consuming application and posting it to a concealed endpoint. Join the discussion | GCVE Database | 08/25/2026, 08:10:48 UTC Added: 08/25/2026, 13:38:48 UTC |
Showing 1 to 1 of 1 result