@tjmlgd/svg@1.0.5

Analysis

This package is published as "SVG assets" but ships no plain images: each .svg file wraps a full HTML document in an SVG <foreignObject> with inline JavaScript, so opening one runs a web application. The files are a collection of proxy/filter-bypass apps and cloned site pages: logo.svg reproduces an IXL Learning page and loads a remote script from hxxps://cdn[.]21baseballacademy[.]com/script/jrqK2HPsliMjRW5Q[.]js together with the scramjet (./runtime/scramjet/scramjet.all.js) and baremux (./runtime/baremux/index.js) web-proxy runtimes; securly.svg probes chrome-extension://<id>/tt-alert.svg for five extension IDs (iheobagjkfklnlikgihanlhcddjoihkg, joflmkccibkooplaeoinecjbmdebglab, ckecmkbnoanpgplccmnoikfmpcdladkc, kfiocjonplkilcjfgabfngiddebalkod, bmlalgfmolfmkjmnikbphgijefopggme) to detect the Securly school filter and then opens 400x1 popup windows cycling www/useast-www/useast2-www/ca-www/uk-www[.]securly[.]com/please_wait/<i>/<total>?utm_*= padded to 4096 characters, and includes instructions to save the page as HTML and import bookmarks; catclass.svg is a base64+gzip HTML app whose login form POSTs email and password to hxxps://hub[.]catclass[.]space/api/auth/ and stores the returned token in localStorage under cc_pro_token, and which loads hxxps://unpkg[.]com/@cetyped/cesbuild@1[.]0[.]2/embed[.]svg; duckmath.svg (1.5 MB of the 1.7 MB package) hides a gzipped base64 blob that is decoded at runtime with DecompressionStream and executed as a blob script; svg/sw.js is a service worker that takes its asset base from a base64 "base" query parameter, falls back to a reversed-string URL under cdn[.]jsdelivr[.]net/gh/TongSgHerbet/, and importScripts a remote sw.js, with dev-mode hosts including localhost, 127[.]0[.]0[.]1 and ngrok-free. The package has no install scripts and no dependencies; the risk is that the shipped files are executable web content misrepresented as static SVG assets, with remote code fetched from a non-standard host and from a jsDelivr GitHub path at run time.