registry / vite-svg-config / 1.1.0

vite-svg-config@1.1.0

A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Calling getPlugin or setPlugin on an SVG path silently spawns a decoded npm install command, then dynamically loads the installed module. This creates remote package lifecycle/code execution outside declared dependencies.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Explicit getPlugin/setPlugin invocation on a file or directory containing SVG files.

Impact

Arbitrary code from the undeclared registry package can execute in the invoking project's environment.

Mechanism

Obfuscated npm package installation followed by dynamic require and plugin invocation.

Attack narrative

The exported directory scanners call validation for each SVG. Validation decodes a Base64 command, spawns it with output hidden, and after it closes decodes a module name, requires it, and invokes its plugin method. The decoded command installs an undeclared package with npm using silent/no-save flags, allowing its installation hooks and exported code to run in the caller's project.

Rationale

This is a concealed staged remote-code-execution chain in a package presented as an SVG utility. It is reachable through documented runtime APIs, despite no install hook in this package's manifest.

Evidence

index.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

vite-svg-config@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code