@vite-mcp/vite-type

GHSA-cf2w-h63w-wm84

Malicious code in @vite-mcp/vite-type (npm)

Details

**Severity:** Critical

**Affected versions:** `= 6.44.1`

## Source: amazon-inspector (9828d7f04091054759c65d427b8f9d7b2853a8a062f9ca261a37e0a0bbc231d0)
Package @vite-mcp/[email protected] impersonates the legitimate vite package: package.json declares name '@vite-mcp/vite-type', author 'Evan You', repository 'github.com/vitejs/vite', and a bin entry 'vite' → 'bin/vite.js', while shipping a copy of the vite source tree to look authentic. Appended to bin/vite.js, after a long whitespace-padded line intended to push it past editor viewports, is an obfuscated IIFE that uses a Fisher-Yates-style string-permutation decoder keyed to the integer 4606094 to reconstruct identifiers ('require','https','get','child_process','spawn','eval','JSON.parse'). At runtime it performs an HTTPS GET and a JSON-RPC POST to a remote host, XOR-decodes the response, passes the result to eval(), and additionally invokes child_process.spawn(..., {detached:true, stdio:..., windowsHide:true}) to run the decoded payload as a hidden detached process. The loader fires whenever the shipped 'vite' bin is invoked (e.g. via 'npx vite' or a project's npm scripts), giving the publisher arbitrary remote code execution on any developer or build host that runs this CLI. Combined with the brand/author/repository impersonation of vitejs/vite, this is a deliberate supply-chain attack against developers who mistakenly install this scope.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/5d940078cdc77cc3f22393c3db9fa84fc7c6b977/osv/malicious/npm/@vite-mcp/vite-type/MAL-2026-10525.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/5d940078cdc77cc3f22393c3db9fa84fc7c6b977/osv/malicious/npm/@vite-mcp/vite-type/MAL-2026-10525.json
- https://www.npmjs.com/package/@vite-mcp/vite-type/v/6.44.1
- https://github.com/advisories/GHSA-cf2w-h63w-wm84

Compromised versions (1)

= 6.44.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.