vite-pwa-config impersonates the popular vite-plugin-pwa package by copying its metadata and README instructions. When the exported configJson/configField is used in a project's vite.config, it runs a detached Node.js child process that fetches JavaScript code from https://www.jsonkeeper.com/b/FNOBS and executes it using new Function with require access. The remote URL is hidden behind a local process.env shim to disguise the fetch as normal configuration loading. The use of a detached, silenced child process and a mutable anonymous paste host for the remote code enables arbitrary code execution in the developer's environment and evades casual review. This is a malicious package designed as a remote-fetch-and-eval dropper via typosquatting.

Users who install and invoke vite-pwa-config versions 1.1.1 or 1.1.2 in their build environment risk arbitrary code execution with full require access. This can lead to compromise of the developer environment, potential theft of credentials or source code, and supply chain contamination. The remote code is fetched from a mutable anonymous paste site, allowing the attacker to change payloads at will. There are no known exploits in the wild yet.

No official patch or fix is currently available for vite-pwa-config. Users should immediately stop using this package and remove it from their projects. Verify that the legitimate vite-plugin-pwa package is used instead. Avoid installing packages from untrusted or typosquatted names. Monitor your environment for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.