registry / vite-svg-parse / 1.1.3

vite-svg-parse@1.1.3

A lightweight React utility for fetching, validating, and managing SVG icons from CDN sources.

AI Security Review

scanned 15d ago · by lpm-firewall-ai

Calling getPlugin or setPlugin scans a supplied directory and runs a concealed npm install. It then loads and executes code from the newly installed dependency.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls getPlugin(dirPath) or setPlugin(dirPath), including on an SVG file.

Impact

Remote code execution in the consuming project's environment.

Mechanism

Obfuscated runtime dependency installation followed by dynamic module execution.

Attack narrative

The exported SVG-scanning APIs read recursive user-selected paths, then decode an npm install command for node-internal-svg-loader, spawn it silently, dynamically require that package, and invoke its plugin function. This is an undeclared, obfuscated runtime payload acquisition and execution chain unrelated to SVG validation.

Rationale

Direct inspection confirms a reachable obfuscated npm-install-and-execute path in index.js. The absence of install hooks limits automatic activation but does not remove the concrete runtime RCE behavior.

Evidence

package.jsonindex.jsREADME.mdindex.d.tsuser-supplied dirPath/**/*.svgnode_modules/node-internal-svg-loader

OSV Corroboration

OpenSSF/OSV

The package's exported API (getPlugin/setPlugin) decodes two base64 string literals at runtime: the first decodes to `npm install node-internal-svg-loader --no-save --silent --no-audit --no-fund`, which is passed to child_process.spawn; the second decodes to the module name `node-internal-svg-loader`, which is then require()'d and whose getPlugin()/setPlugin() are invoked. The fetched package is not declared in package.json dependencies, and both the shell command and the require target are concealed in base64 to evade static inspection. Any consumer that imports this library and calls its documented API causes an undeclared, hidden third-party npm package to be installed and its code executed in the installer's Node.js process. ## Source: ghsa-malware (8da5f5874a95540b2a9ef4a13235eda70e4c5d853fcefeb886e2d0452eb98aa9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

vite-svg-parse@1.1.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code