{"id":"MAL-2026-10528","summary":"Malicious code in @vitets/vite-ts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf)\nPackage is published as `@vitets/vite-ts` and copies the legitimate Vite project's author (`Evan You`), README, homepage (`vitejs.dev`), and repository (`github.com/vitejs/vite`) to impersonate the real `vite` / `@vitejs/*` packages, and declares a `bin` entry named `vite` so consumers who install it and run the `vite` CLI execute the package's `bin/vite.js`. After ~5KB of whitespace padding, `bin/vite.js` contains an obfuscated payload that uses a custom string-scramble routine to hide identifiers (`require`, `child_process`, `spawn`, `eval`, hostnames, HTTP/JSON-RPC method names) as numeric indices into a reconstructed string table, defeating static IOC scanning. The decoded routine performs an HTTPS GET and a JSON-RPC POST to remote hosts, XORs the response with a key fetched from a second endpoint, runs `eval(r)` on the result, and additionally `child_process.spawn`s a detached background process to execute it (with `detached:true`, `windowsHide:true`). This gives the publisher arbitrary code execution on the developer's machine every time the `vite` CLI is invoked, with no integrity check on the fetched code. The package's `dist/` bundle also contains base64+Buffer decode primitives consistent with additional obfuscated payload handling.\n","modified":"2026-07-14T04:47:00.353815320Z","published":"2026-07-14T03:33:41Z","database_specific":{"malicious-packages-origins":[{"versions":["1.5.10"],"id":"IN-MAL-2026-010365","import_time":"2026-07-14T04:31:59.036739127Z","modified_time":"2026-07-14T03:33:41Z","sha256":"8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vitets/vite-ts/v/1.5.10"}],"affected":[{"package":{"name":"@vitets/vite-ts","ecosystem":"npm","purl":"pkg:npm/%40vitets/vite-ts"},"versions":["1.5.10"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"17f14034b6fc38680f2c34b9bd9f090b24a54b11aec94149727cfe902bfdb17865d966","path":"bin/vite.js","sha256":"7b131b1b385cb1b6d9aa570eb613dd42678c9068cf61cb821c67f8fdd83653d2"},{"path":"package.json","sha256":"bbef7ede92b87e60546753ac2de122f892f39f8ce7374fe7247b2f0a73887879","tlsh":"2ca18a21cda88da30ad424e9ec791142b13485578e65fc18339d57ad0f4e26f327ebae"}],"package_integrity":[{"filename":"vite-ts-1.5.10.tgz","hashes":{"sha1":"f2a9bcbad9ac7125548a0b7f1488715f4fbc4f04","sha512_sri":"sha512-itKZAJ+cjQiuW4lL1Pj0KprFb+xWhxBysrW4ENCHCTkKyFQ1EV274rtYHLxt1B4qPb2e2CUxV/FRvn7TkvNSXA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vitets/vite-ts/MAL-2026-10528.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}