MAL-2026-14480 Malicious code in vite-plugin-image-analysis (npm)

The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline <script> into every built HTML page. The injected script reads user identity fields (account/username/userNo, phone, realName) from sessionStorage.userInfo, hooks sessionStorage.setItem so the beacon fires after login writes these fields, and sends the values along with host and OS to a remote endpoint. The destination URL is not a plain literal: a base64 blob is decoded and XOR'd with 42 at runtime in the victim's browser (atob(_c).split('').map(c => String.fromCharCode(c.charCodeAt(0) ^ 42)).join('')), and the outbound query string is similarly XOR(42)+base64 wrapped. Delivery uses stealth transports — navigator.sendBeacon, fetch(..., { mode: 'no-cors', referrerPolicy: 'no-referrer' }) — that suppress network-panel visibility and referrer leakage. A developer who adds this plugin to their Vite build unknowingly ships a covert end-user PII scraper into their production site, with the exfil destination hidden from anyone inspecting the built bundle.