MAL-2026-10439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-hot-svg/MAL-2026-10439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10439
Published
2026-07-13T09:21:48Z
Modified
2026-07-13T10:47:00.793361160Z
Summary
Malicious code in react-hot-svg (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051)

index.js in react-hot-svg 1.1.4 hides both a shell command and a package name as base64 strings named svgValidateKey and svgValidatePattern. When any of the exported API surface (getPlugin, setPlugin, validateSvgContent) is invoked, the code decodes svgValidateKey via atob to the string npm install rollup-plugin-polyfill-handler --no-save --silent --no-audit --no-fund, spawns it via child_process.spawn with stdio: 'ignore', and on process exit require()s the base64-decoded module name rollup-plugin-polyfill-handler and immediately invokes its .getPlugin()() function. The --no-save --silent --no-audit --no-fund flags suppress output and prevent the added dependency from appearing in package.json or the lockfile. The obfuscation of both the command and the required module name, the SVG-themed cover identifiers, and the pattern of installing-then-requiring-then-executing an undeclared external package match a dropper that lands and executes attacker-controlled code from a separate npm package on any consumer who uses this library's advertised API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "7c59d0dbdaeea673db1067ec280a93ab744a5fb5f60ba8938698b46fbddcae7c",
            "modified_time": "2026-07-13T09:22:10Z",
            "versions": [
                "1.1.5"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010205",
            "import_time": "2026-07-13T10:37:37.613201029Z"
        },
        {
            "sha256": "847fe0ea93982597b0611e6fd23f1b77af40b7162baf338659fbff8deb7fb051",
            "modified_time": "2026-07-13T09:21:48Z",
            "versions": [
                "1.1.4"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-010202",
            "import_time": "2026-07-13T10:37:37.34860253Z"
        }
    ]
}
References
Credits

Affected packages

npm / react-hot-svg

Package

Name
react-hot-svg
View open source insights on deps.dev
Purl
pkg:npm/react-hot-svg

Affected ranges

Affected versions

1.*
1.1.4
1.1.5

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "4ca08d88e0169cf0e26dc96f5b9810350c3d10e67dee7fc0ba457d329ff3fcdc",
            "tlsh": "0e2255911c8731228c72c7fe5d02841eeb8ed3273215619e7dbc92501f7a7a042aeeec",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-OlaXcnyeiAXYgZdj1SEXhjV5YnL0UTWICbfPziWx50687JxIhM2IbXqw9FxQboZ8gLjaAZd4Q7co+jeqvsqHYA==",
                "sha1": "c7b3985d9225728445abec3e521f3a8fcbebe0e0"
            },
            "filename": "react-hot-svg-1.1.5.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/react-hot-svg/MAL-2026-10439.json"