MAL-2026-14479

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-bug-tracker/MAL-2026-14479.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14479
Published
2026-08-25T08:10:02Z
Modified
2026-08-25T23:49:44.328160667Z
Summary
Malicious code in vite-plugin-bug-tracker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882)

The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by the developer's Vite build. At runtime in the end user's browser, that injected script reads personally identifiable information from sessionStorage (account/username, phone number, real name via fields such as i.phone and i.realName) and transmits it via fetch (mode: 'no-cors'), sendBeacon, or an Image request. The destination URL is not written in cleartext: it is assembled at runtime by base64-decoding a bundled string and XOR-ing each byte with 42 (atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')). The exfiltration query string is likewise XOR+base64 encoded before being appended. The plugin also monkey-patches sessionStorage.setItem so that any write matching the configured scope triggers immediate exfiltration. As a result, applications built with this plugin ship a PII harvester to their production users whose reporting endpoint cannot be identified by inspecting the built bundle or a browser network trace at a glance.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-25T08:20:36.751644875Z",
            "sha256": "127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-018701",
            "modified_time": "2026-08-25T08:10:12Z"
        },
        {
            "import_time": "2026-08-25T08:20:36.668891566Z",
            "modified_time": "2026-08-25T08:10:02Z",
            "sha256": "eb97158be41e6a6e36740b2b1dba4186f54b8eb8648fc2e6cdcb5a02b7451d99",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018700",
            "versions": [
                "1.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vite-plugin-bug-tracker

Package

Name
vite-plugin-bug-tracker
View open source insights on deps.dev
Purl
pkg:npm/vite-plugin-bug-tracker

Affected ranges

Affected versions

1.*
1.0.0
1.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "9761557b7063526566b224ab017f8428d3be89035c6af524be5d81076fcc72c067ebf5",
            "sha256": "d79a3255da99bf71911a0f01536d58cb00e88cedca37de250903c34549ec7182",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-plugin-bug-tracker-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-YvZ2lgNXCZJiMgR06M4iTPWbpx9fPr9dNLgdKPAnUWuf6MKLOP5w7iWLD99ByGyBOJjwQ7uU8w9yYBtC8JlCJw==",
                "sha1": "7a0f462098e700782d79dea47059225c68325ef6"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-bug-tracker/MAL-2026-14479.json"