{"id":"MAL-2026-10526","summary":"Malicious code in @vite-pro/vite-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7)\nPackage `@vite-pro/vite-ui` impersonates the official `vite` package: `package.json` declares author `Evan You`, points `repository` at `github.com/vitejs/vite`, sets `homepage` to `vitejs.dev`, ships the upstream Vite README, and exposes a `bin` named `vite`. Appended to the end of `bin/vite.js`, after the legitimate CLI bootstrap and a large block of trailing whitespace, is an obfuscated IIFE that constructs a string table via a seeded Fisher-Yates shuffle (seed 4606094) to hide endpoints, method names, and constants. The loader then fetches a remote payload over HTTP, XOR-decrypts it with an embedded key, and `eval`s the result. It subsequently fetches a second payload and passes it to `child_process.spawn` with `detached:true`, `stdio:'ignore'`, and `windowsHide:true`, establishing a hidden, long-running process independent of the parent `vite` invocation. The loader runs every time a developer executes `vite`, `npx vite`, or `npm run dev|build`, giving the attacker arbitrary code execution and a persistent background process on the developer machine on each CLI use. The obfuscation technique (seeded string-array shuffle + XOR + eval + detached spawn) matches reported blockchain-C2 loader families.\n","modified":"2026-07-14T04:46:59.111914190Z","published":"2026-07-14T03:33:15Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-07-14T03:33:15Z","sha256":"9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7","source":"amazon-inspector","versions":["2.5.10"],"id":"IN-MAL-2026-010362","import_time":"2026-07-14T04:31:58.915148089Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vite-pro/vite-ui/v/2.5.10"}],"affected":[{"package":{"name":"@vite-pro/vite-ui","ecosystem":"npm","purl":"pkg:npm/%40vite-pro/vite-ui"},"versions":["2.5.10"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vite-pro/vite-ui/MAL-2026-10526.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"vite-ui-2.5.10.tgz","hashes":{"sha1":"e799eeec184fc6b8fdd991d316e3d45d2ef5d69c","sha512_sri":"sha512-OzGju0Ivno3sJZDSdFP3up/3yWfqDyygeMq9RXr5bdszRkdlJpKpl7h135HRW6Hq93utLgLhvLOHSAy+jkIUJw=="}}],"evidence_files":[{"path":"package.json","sha256":"47c275ea776bc1207d14ecedf2c12baaa9e45afefa58bac56443df641cb0ebf3","tlsh":"bca18925cda88da30ad420e9ec791143b13485578e65fc18339d57ad0f4e26f327ebae"},{"tlsh":"54f14134b6fc38680f2c34b9bd9f090b24a54b11aec94149727cfe902bfdb17865d966","path":"bin/vite.js","sha256":"622b77300ec552a5aaed5347f19c56ecc4fb7717563d800e8c15868d06bd8223"}]}}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}