Malicious code in vite-svg-config (npm)
The npm package vite-svg-config contained malicious code that silently installs and executes a second package (node-internal-svg-loader) when the advertised plugin API is called. The attack was obfuscated using base64-encoded constants and misleading function names.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of vite-svg-config that calls the getPlugin/setPlugin functions
- Ecosystems
- Attack vectors
- Affected entities
- vite-svg-confignpm package containing malicious code
The npm package vite-svg-config was found to contain malicious code embedded in its getPlugin and setPlugin functions. The package decoded two base64-encoded constants at runtime: svgValidateKey and svgValidatePattern.
svgValidateKey decoded to the shell command npm install node-internal-svg-loader --no-save --silent --no-audit --no-fund, which was executed with suppression flags (stdio:'ignore', windowsHide:true, shell:true on Windows). svgValidatePattern decoded to the package name node-internal-svg-loader, which was then dynamically required and invoked.
The attack was designed to be stealthy: the command and package name were hidden behind base64 encoding and misleading identifiers framed as SVG validation logic. The silencing flags (--silent, --no-audit, --no-fund, windowsHide) prevented user-visible output of the installation. Any consumer calling the package's advertised plugin API would unknowingly pull and execute code from a separate npm package controlled by the attacker.
The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-xjpr-cvvp-8v27.
Indicators of compromise
- Packages
- vite-svg-config
- node-internal-svg-loader
Remediation
- Remove vite-svg-config from all projects immediately
- Audit npm install logs and process history for unexpected installations of node-internal-svg-loader or similar packages
- Review and revoke any credentials or tokens that may have been exposed on affected machines
- Use npm audit to scan for other malicious packages
- Consider using package signature verification and supply chain security tools to detect similar attacks
Sources
- GitHub Advisory GHSA-xjpr-cvvp-8v27 · GitHub Advisory Database
Cite this entry
"Malicious code in vite-svg-config (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-vite-svg-config-npm-g54k41
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in 3-buildsight-web (npm)
The npm package 3-buildsight-web contains malicious code that fetches and executes arbitrary JavaScript from a remote Bitbucket URL on module load, granting full page privileges to an unverified third party.
npmCompromised package - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @syncraft-labs/vue (npm)
The npm package @syncraft-labs/vue version 0.4.1 contained malicious obfuscated code in its ESM build that implements a blockchain-hosted C2 dropper (EtherHiding pattern), enabling remote code execution on any consumer importing the package.
npmCompromised package