registry / vite-config-svg / 1.1.7

vite-config-svg@1.1.7

A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Calling getPlugin or setPlugin recursively reads caller-selected SVG paths, silently installs an undeclared package into the current project, then loads it. This creates remote code execution through a registry-fetched dependency.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Caller invokes getPlugin() or setPlugin() on a directory containing an SVG, or a non-directory path.

Impact

Unconsented installation and execution of remote package code in the consumer environment.

Mechanism

obfuscated npm install followed by dynamic require and invocation

Attack narrative

A caller using the documented SVG scan APIs reaches validateSvgContent. Its Base64 command installs rollup-plugin-polyfill-helper with silent flags and no manifest entry. On completion, the package dynamically requires that dependency and calls getPlugin or setPlugin. Thus ordinary local SVG scanning silently pulls and executes registry-controlled code in the consumer project.

Rationale

The concealed runtime install and execution are unrelated to SVG validation and constitute a concrete malicious execution chain. Lack of an npm lifecycle hook limits activation to explicit API use but does not remove the risk.

Evidence

package.jsonindex.jsREADME.mdindex.d.ts<caller-supplied dirPath>/**/*.svgnode_modules/rollup-plugin-polyfill-helper

vite-config-svg@1.1.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code