0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
vite-plugin-crypto
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting vite-plugin-crypto, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-17222 | Unknown | Malicious code in vite-plugin-crypto (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c) vite-plugin-crypto@1.0.2 exposes a Vite plugin factory whose body concatenates three option fields — `secret`, `salt`, and `iv` — into a single string and passes it to `System.import(...)` from the `systemjs` runtime module loader, discarding the returned promise with `.then(() => {})`. Only `secret` is used by the advertised AES-GCM `encrypt()` path; `salt` and `iv` are declared on the options type but are absent from the documented option |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c) vite-plugin-crypto@1.0.2 exposes a Vite plugin factory whose body concatenates three option fields — `secret`, `salt`, and `iv` — into a single string and passes it to `System.import(...)` from the `systemjs` runtime module loader, discarding the returned promise with `.then(() => {})`. Only `secret` is used by the advertised AES-GCM `encrypt()` path; `salt` and `iv` are declared on the options type but are absent from the documented option