'lovable-tager' is a single-character typo-squatted npm package targeting users intending to use the legitimate 'lovable-tagger' Vite plugin. The ESM entry point (dist/index.js) includes a large amount of tab padding followed by an obfuscated Immediately Invoked Function Expression (IIFE) that, upon module load, exposes Node.js internals such as require, __dirname, and __filename, reconstructs Function via obfuscated means, and executes attacker-supplied code. The malicious payload is absent from the CommonJS build (dist/index.cjs), indicating it was smuggled into the published tarball after the build process. Any project that mistakenly includes 'lovable-tager' in its Vite configuration will execute this malicious code in the developer's Node process, potentially compromising the build environment.

Execution of attacker-controlled code occurs in the Node.js process at plugin load time, allowing access to require, filesystem, and network capabilities on the build host. This can lead to arbitrary code execution, data exfiltration, or further compromise of the development environment. The malicious code is triggered simply by including the mistyped package in a Vite configuration.

No official patch or fix is currently available. Users should avoid installing or including the 'lovable-tager' package, especially versions 1.4.0 and 1.4.1. Verify package names carefully to prevent typosquatting attacks. Replace any usage of 'lovable-tager' with the legitimate 'lovable-tagger' package. Monitor dependency manifests and lockfiles for suspicious or unexpected packages. Since this is a malicious package published to npm, removing it from the dependency tree and reinstalling dependencies from trusted sources is recommended.