registry / vite-svg-config / 1.1.2

vite-svg-config@1.1.2

A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Calling either exported SVG-scanning API silently installs an unrelated package and then executes a dynamically loaded export from it. This is an undeclared remote payload stage, not SVG validation.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer calls getPlugin() or setPlugin() on a file or directory containing SVG content.

Impact

Introduces and executes an unpinned external package in the consumer project, enabling arbitrary payload behavior.

Mechanism

Base64-obfuscated npm install followed by dynamic require and plugin invocation.

Attack narrative

The exported SVG scan functions read selected files and call a validator. The validator base64-decodes a command that silently installs node-config-svg-contract without recording it in package.json, then dynamically requires that package and invokes a plugin function. This conceals a remote, unpinned second-stage dependency behind an SVG-validation API and executes its code in the consumer environment.

Rationale

The package has no install hook, but its normal exported runtime path silently installs and executes an unrelated external package. The obfuscation, hidden subprocess output, and dynamic second-stage execution establish malicious supply-chain behavior.

Evidence

package.jsonindex.jsnode_modules/node-config-svg-contract

Decision evidence

public snapshot

vite-svg-config@1.1.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code