MAL-2026-10526

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vite-pro/vite-ui/MAL-2026-10526.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10526
Published
2026-07-14T03:33:15Z
Modified
2026-07-14T04:46:59.111914190Z
Summary
Malicious code in @vite-pro/vite-ui (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7)

Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite, sets homepage to vitejs.dev, ships the upstream Vite README, and exposes a bin named vite. Appended to the end of bin/vite.js, after the legitimate CLI bootstrap and a large block of trailing whitespace, is an obfuscated IIFE that constructs a string table via a seeded Fisher-Yates shuffle (seed 4606094) to hide endpoints, method names, and constants. The loader then fetches a remote payload over HTTP, XOR-decrypts it with an embedded key, and evals the result. It subsequently fetches a second payload and passes it to child_process.spawn with detached:true, stdio:'ignore', and windowsHide:true, establishing a hidden, long-running process independent of the parent vite invocation. The loader runs every time a developer executes vite, npx vite, or npm run dev|build, giving the attacker arbitrary code execution and a persistent background process on the developer machine on each CLI use. The obfuscation technique (seeded string-array shuffle + XOR + eval + detached spawn) matches reported blockchain-C2 loader families.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "2.5.10"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-07-14T04:31:58.915148089Z",
            "modified_time": "2026-07-14T03:33:15Z",
            "sha256": "9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7",
            "id": "IN-MAL-2026-010362"
        }
    ]
}
References
Credits

Affected packages

npm / @vite-pro/vite-ui

Package

Name
@vite-pro/vite-ui
View open source insights on deps.dev
Purl
pkg:npm/%40vite-pro/vite-ui

Affected ranges

Affected versions

2.*
2.5.10

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "bca18925cda88da30ad420e9ec791143b13485578e65fc18339d57ad0f4e26f327ebae",
            "sha256": "47c275ea776bc1207d14ecedf2c12baaa9e45afefa58bac56443df641cb0ebf3",
            "path": "package.json"
        },
        {
            "tlsh": "54f14134b6fc38680f2c34b9bd9f090b24a54b11aec94149727cfe902bfdb17865d966",
            "sha256": "622b77300ec552a5aaed5347f19c56ecc4fb7717563d800e8c15868d06bd8223",
            "path": "bin/vite.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-ui-2.5.10.tgz",
            "hashes": {
                "sha512_sri": "sha512-OzGju0Ivno3sJZDSdFP3up/3yWfqDyygeMq9RXr5bdszRkdlJpKpl7h135HRW6Hq93utLgLhvLOHSAy+jkIUJw==",
                "sha1": "e799eeec184fc6b8fdd991d316e3d45d2ef5d69c"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vite-pro/vite-ui/MAL-2026-10526.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]