The malicious npm package vite-plugin-config-paths (version 1.4.2) impersonates the widely used vite-plugin-tsconfig-paths by mimicking its homepage and README. The CommonJS entry point (index.js) contains top-level code that invokes a function retrieved by name from a transitive dependency 'url-func-registry' at load time, enabling dynamic execution of hidden code. This behavior is absent in the ESM entry (index.mjs), indicating the CommonJS output was altered post-build to include this malicious code. The use of a named-function table populated by another package allows the actual malicious behavior to be changed without republishing vite-plugin-config-paths itself. This pattern is characteristic of a typosquatting dropper designed to trick users into installing it while executing hidden malicious payloads.

This package can execute arbitrary code at load time in environments that use the CommonJS module system, potentially leading to compromise of the development environment or build processes that depend on this package. The dynamic invocation of functions from a transitive dependency allows the malicious behavior to be altered or extended without updating the package itself, increasing the risk of undetected malicious activity.

No official patch or fix is currently available for this malicious package. Users should avoid installing vite-plugin-config-paths version 1.4.2 and instead use the legitimate vite-plugin-tsconfig-paths package. Verify package names carefully before installation to avoid typosquatting attacks. Remove any installations of vite-plugin-config-paths from projects and dependency trees. Monitor for and block this package in internal registries or package management policies.