The react-next-vite npm package (version 1.2.9) masquerades as the pino logger but contains malicious functionality. When its default export middleware factory is invoked, it spawns a detached child Node.js process that silently fetches a JavaScript payload from a mutable IPFS gateway URL. This payload is dynamically executed with require in scope, granting it full access to the host environment. Additional configuration endpoints are concealed as base64-encoded strings within fake environment variable objects, serving as a second-stage command and control channel. This combination of identity impersonation, stealthy detached child process execution, remote code fetch-and-eval, and hidden configuration URLs constitutes a fully weaponized dropper capable of compromising any consumer using this package version.

Any application that installs and uses react-next-vite version 1.2.9 and invokes its default export middleware is at risk of remote code execution. The malicious code runs with full Node.js runtime privileges, enabling arbitrary code execution, potential data theft, system compromise, or further malware deployment. The use of a detached child process and hidden configuration URLs increases stealth and persistence, complicating detection and response.

No official patch or remediation is currently documented for this malicious package version. The best mitigation is to avoid using react-next-vite version 1.2.9 entirely. Remove this package from any projects and replace it with a trusted alternative. Monitor package sources carefully to avoid installing similarly impersonating or malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.