MAL-2026-10528

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vitets/vite-ts/MAL-2026-10528.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10528
Published
2026-07-14T03:33:41Z
Modified
2026-07-14T04:47:00Z
Summary
Malicious code in @vitets/vite-ts (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf)

Package is published as @vitets/vite-ts and copies the legitimate Vite project's author (Evan You), README, homepage (vitejs.dev), and repository (github.com/vitejs/vite) to impersonate the real vite / @vitejs/* packages, and declares a bin entry named vite so consumers who install it and run the vite CLI execute the package's bin/vite.js. After ~5KB of whitespace padding, bin/vite.js contains an obfuscated payload that uses a custom string-scramble routine to hide identifiers (require, child_process, spawn, eval, hostnames, HTTP/JSON-RPC method names) as numeric indices into a reconstructed string table, defeating static IOC scanning. The decoded routine performs an HTTPS GET and a JSON-RPC POST to remote hosts, XORs the response with a key fetched from a second endpoint, runs eval(r) on the result, and additionally child_process.spawns a detached background process to execute it (with detached:true, windowsHide:true). This gives the publisher arbitrary code execution on the developer's machine every time the vite CLI is invoked, with no integrity check on the fetched code. The package's dist/ bundle also contains base64+Buffer decode primitives consistent with additional obfuscated payload handling.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010365",
            "import_time": "2026-07-14T04:31:59.036739127Z",
            "modified_time": "2026-07-14T03:33:41Z",
            "sha256": "8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf",
            "source": "amazon-inspector",
            "versions": [
                "1.5.10"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @vitets/vite-ts

Package

Name
@vitets/vite-ts
View open source insights on deps.dev
Purl
pkg:npm/%40vitets/vite-ts

Affected ranges

Affected versions

1.*
1.5.10

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "bin/vite.js",
            "sha256": "7b131b1b385cb1b6d9aa570eb613dd42678c9068cf61cb821c67f8fdd83653d2",
            "tlsh": "17f14034b6fc38680f2c34b9bd9f090b24a54b11aec94149727cfe902bfdb17865d966"
        },
        {
            "path": "package.json",
            "sha256": "bbef7ede92b87e60546753ac2de122f892f39f8ce7374fe7247b2f0a73887879",
            "tlsh": "2ca18a21cda88da30ad424e9ec791142b13485578e65fc18339d57ad0f4e26f327ebae"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-ts-1.5.10.tgz",
            "hashes": {
                "sha1": "f2a9bcbad9ac7125548a0b7f1488715f4fbc4f04",
                "sha512_sri": "sha512-itKZAJ+cjQiuW4lL1Pj0KprFb+xWhxBysrW4ENCHCTkKyFQ1EV274rtYHLxt1B4qPb2e2CUxV/FRvn7TkvNSXA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@vitets/vite-ts/MAL-2026-10528.json"