@vite-ln/build-ts is a malicious npm package impersonating the legitimate vite package by copying its manifest but published under an unofficial scope. Its tarball appends an obfuscated payload to the CLI entry point that dynamically fetches attacker-controlled code via HTTP(S) GET and JSON-RPC 2.0 POST requests from blockchain RPC endpoints. The retrieved payload is XOR-decoded and executed both via eval and as a detached hidden Node.js child process, enabling persistent remote code execution with developer-level privileges. Additional obfuscation patterns are present in other package files, indicating a sophisticated evasion technique. Any system running this package is considered fully compromised.

Execution of attacker-controlled code with full developer privileges on any system running the malicious package. Persistent hidden processes may remain after initial execution, leading to full system compromise. All secrets and keys stored on the affected system are at risk and should be rotated. Removal of the package does not guarantee removal of all malicious artifacts or persistence mechanisms.

No official patch or fix is available for this malicious package. The package should be immediately removed from all systems. All secrets and keys stored on affected machines must be rotated from a separate, trusted environment. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild or forensic investigation is recommended. Monitor for any detached node processes and suspicious network activity related to blockchain RPC endpoints. Avoid installing packages from unofficial or suspicious scopes.