MAL-2026-14140

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-svg-config/MAL-2026-14140.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14140
Published
2026-08-18T22:47:03Z
Modified
2026-08-18T23:15:11.609382618Z
Summary
Malicious code in vite-svg-config (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f)

The package's exported getPlugin/setPlugin functions decode two base64 constants (svgValidateKey, svgValidatePattern) at runtime. svgValidateKey decodes to the shell command npm install node-internal-svg-loader --no-save --silent --no-audit --no-fund, which is spawned with stdio:'ignore', windowsHide:true, and shell:true on Windows. svgValidatePattern decodes to the package name node-internal-svg-loader, which is then dynamically required and whose getPlugin() export is invoked. The command and target package name are both hidden behind base64 constants and misleading identifiers framed as SVG validation. Silencing flags (--silent, --no-audit, --no-fund, windowsHide) suppress user-visible output of the install. The result is that any consumer calling the package's advertised plugin API pulls and executes a separate npm package, whose contents are controlled by whoever owns that name, on the caller's machine.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T23:09:41.488073968Z",
            "sha256": "38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f",
            "modified_time": "2026-08-18T22:47:03Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018172",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vite-svg-config

Package

Name
vite-svg-config
View open source insights on deps.dev
Purl
pkg:npm/vite-svg-config

Affected ranges

Affected versions

1.*
1.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-svg-config/MAL-2026-14140.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "e5e728d799c81d15dbebdae0d8d7851326168222c3576b66de54c99558bb1601",
            "path": "index.js",
            "tlsh": "462233912cd731228d72c7fe5901841eeb8ed3273215619e7ebc92501f7a7a041aeeec"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-svg-config-1.1.0.tgz",
            "hashes": {
                "sha1": "0028546312c53c5a5ad0b844960857b754578de2",
                "sha512_sri": "sha512-gZ6QfUtgBorvs2nzZqxd3Nw5EmjGzoSJWH2mutumypcaxDmUssTLdjdtqPXuTp2fqqjE85ZPXLrOzmAjX3QcAA=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]