MAL-2026-10574

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-config-paths/MAL-2026-10574.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10574
Published
2026-07-14T06:04:15Z
Modified
2026-07-14T07:19:19Z
Summary
Malicious code in vite-plugin-config-paths (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7)

Package name impersonates the widely-used vite-plugin-tsconfig-paths (the package.json homepage points to the legitimate plugin's README), and the README markets the same API. The CJS entry (index.js) contains top-level code that is absent from the ESM entry (index.mjs): const { getFunc } = require("url-func-registry"); const jsonInst = getFunc("JsonS"); const json_provider = jsonInst();. On require() of this package (the resolution path Node uses for CommonJS consumers), a function looked up by string name from a transitive url-func-registry dependency is invoked at load time. This registry-lookup indirection hides the executed code behind a named-function table populated by a separate package, so the actual behavior can be altered by changing that transitive without republishing this one. The ESM build performs no such call, indicating the CJS output was modified after normal build. The combination of name impersonation of a popular target plus divergent, indirection-based load-time execution not part of the advertised tsconfig-path resolution logic is the shape of a typosquat dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010484",
            "import_time": "2026-07-14T06:49:57.08326298Z",
            "modified_time": "2026-07-14T06:04:15Z",
            "sha256": "96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7",
            "source": "amazon-inspector",
            "versions": [
                "1.4.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vite-plugin-config-paths

Package

Name
vite-plugin-config-paths
View open source insights on deps.dev
Purl
pkg:npm/vite-plugin-config-paths

Affected ranges

Affected versions

1.*
1.4.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "d04efcdb15066643c5b7238c232322329bf94cbf0241a0d680c0779611afaed8",
            "tlsh": "c7212925c8a94d930ae42a64ec595943b23255d34e18bd083bd6512c4fbd2ef42bf27e"
        },
        {
            "path": "index.js",
            "sha256": "656bf32782665249a3dbb88afaba11d2eea2c75e77db7a4c99198f13e5dcf8fb",
            "tlsh": "9891740314fb101749a3958aaa378d216776a2e30e14bd84bbfce3f00f5e19d19f2b56"
        }
    ],
    "package_integrity": [
        {
            "filename": "vite-plugin-config-paths-1.4.2.tgz",
            "hashes": {
                "sha1": "011a5d980ca33829db39d770e97dae5ba64a78db",
                "sha512_sri": "sha512-bp0rwIPjy4zNYmDZhgc2TS1I9QNh4IX/XfBkUtsNMLvg63fh/lWKXY4b52UEBNpk5XhIA0SBzaT2wDn/nAYA0g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-config-paths/MAL-2026-10574.json"