MAL-2026-14480

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-image-analysis/MAL-2026-14480.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14480
Published
2026-08-25T08:09:38Z
Modified
2026-08-25T23:50:43.697900779Z
Summary
Malicious code in vite-plugin-image-analysis (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04)

The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline <script> into every built HTML page. The injected script reads user identity fields (account/username/userNo, phone, realName) from sessionStorage.userInfo, hooks sessionStorage.setItem so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — navigator.sendBeacon, fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' }) — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.1.0"
            ],
            "source": "amazon-inspector",
            "sha256": "8d80c77b7b4e7a90be289a7b97405119318193c25b5429621deeae00f053c77b",
            "id": "IN-MAL-2026-018699",
            "import_time": "2026-08-25T08:20:36.583759673Z",
            "modified_time": "2026-08-25T08:09:53Z"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "b25366a663127e04d26191faf1726924161eb770ca68f649cc1e7e39f0d3b3d6",
            "id": "IN-MAL-2026-018698",
            "import_time": "2026-08-25T08:20:36.504157642Z",
            "modified_time": "2026-08-25T08:09:45Z"
        },
        {
            "versions": [
                "1.1.2"
            ],
            "source": "amazon-inspector",
            "sha256": "e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04",
            "id": "IN-MAL-2026-018697",
            "import_time": "2026-08-25T08:20:36.401473796Z",
            "modified_time": "2026-08-25T08:09:38Z"
        }
    ]
}
References
Credits

Affected packages

npm / vite-plugin-image-analysis

Package

Name
vite-plugin-image-analysis
View open source insights on deps.dev
Purl
pkg:npm/vite-plugin-image-analysis

Affected ranges

Affected versions

1.*
1.0.0
1.1.0
1.1.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "bf81657ba463216596a2206b013f443ce3be85031c5ef564b95d9217afcc62c067eff9",
            "sha256": "4bdce14e80e058993bb0fee538c09aee11d86d3ea0690a4ae679e7074c1e6ff3"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-plugin-image-analysis-1.1.0.tgz",
            "hashes": {
                "sha1": "97d12dc11c60e13eb45622f8028a9eb955e479ea",
                "sha512_sri": "sha512-aMCtJ9R0BY7YVIqInzRYNfqdp9xkUwSwULfi7uQfeXIUC3ta4iuc0NSG6vOtye9kKFk+EFG4hAcxMChINx7x4Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-image-analysis/MAL-2026-14480.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]