vite-tsconfig-svg @1.1.4

Summary

index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit --no-fund and the package name rollup-plugin-polyfill-helper . When a consumer calls the exported getPlugin / setPlugin (reachable indirectly through validateSvgContent ), the module spawns the decoded install command via child_process with stdio:'ignore' and windowsHide:true , then require() s the decoded package name and invokes its getPlugin() / setPlugin() methods. The fetched package is undeclared in dependencies , unpinned, and pulled from the mutable npm registry, so arbitrary attacker-controlled code from rollup-plugin-polyfill-helper executes in the consumer's Node process. The package name and description advertise a vite/tsconfig SVG utility, but no vite/tsconfig code is shipped — the module only scans a caller-supplied directory for .svg files as a cover for the install-and-execute path.

Source: amazon-inspector (a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1)