{"id":"MAL-2026-10527","summary":"Malicious code in @vite-ts/vite-ui (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c6076869d73ce328ffd736c9df9d269cd99e505ffc3bfceae5d3f5a633a8c420)\nPackage @vite-ts/vite-ui@6.44.1 impersonates the legitimate vite package: it clones vite's README, declares author 'Evan You', homepage https://vitejs.dev, repository vitejs/vite, and a bin entry mapping `vite` to bin/vite.js. The shipped bin/vite.js contains an obfuscated IIFE that reconstructs a string table from a shuffled blob using the integer seed 4606094 to hide the strings 'https', 'child_process', 'eval', 'POST', '2.0', and the destination URLs. At runtime the payload issues an HTTPS GET to an Ethereum block-explorer URL and a JSON-RPC POST to an Ethereum node, XOR-decodes the hex result to retrieve JavaScript code from an attacker-controlled smart contract (EtherHiding pattern), and executes the retrieved code via eval(r) and via a detached child_process.spawn('node', ['-e',...+r], { detached: true, windowsHide: true }). The fetched bytes are not pinned, not signature-verified, and are mutable by the contract owner, so any consumer invoking the `vite` CLI from this package runs whatever code the attacker currently has staged on-chain. Additional install-time curl invocations and Buffer.from(...,'base64').toString() decode chains are present in the bundled dist files.\n","modified":"2026-07-14T04:47:00.294481934Z","published":"2026-07-14T03:33:32Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-07-14T04:31:58.995624641Z","modified_time":"2026-07-14T03:33:32Z","sha256":"c6076869d73ce328ffd736c9df9d269cd99e505ffc3bfceae5d3f5a633a8c420","source":"amazon-inspector","versions":["6.44.1"],"id":"IN-MAL-2026-010364"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vite-ts/vite-ui/v/6.44.1"}],"affected":[{"package":{"name":"@vite-ts/vite-ui","ecosystem":"npm","purl":"pkg:npm/%40vite-ts/vite-ui"},"versions":["6.44.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"9f45a5b0ecaa364b920fbc230f5e747a1f9d65d986da07a6f0f73b0d16757044","tlsh":"d4a19b25cda88da30ad420e9ec791142f13485578e65fc18339d57ad0f4e26f327ebae","path":"package.json"},{"path":"bin/vite.js","sha256":"fe7a267f95f960f099a625cb9aae87c5b9da2ce5eb4c860eb59b944c1f7ce6ac","tlsh":"dff14034b6fc38680f2c34b9bd9f090b24a54b11aec94149727cfe902bfdb17865d966"}],"package_integrity":[{"filename":"vite-ui-6.44.1.tgz","hashes":{"sha512_sri":"sha512-SIusvAJs5pmg9ENPBqNa21yE/UbRf9MWYGJOCi8whxb9pgIJibr0czBkZTCVg2apy82GoFhMUJq/ywnGhtzY3A==","sha1":"7cbdd81f5d578ff1e8dcd2f144b2841469ebce2f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vite-ts/vite-ui/MAL-2026-10527.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}