MalwarePublished 9 Jul 2026

lovable-tager (npm) · Malicious Code

Affects lovable-tagerSource GCVE Database

Malicious package : remove lovable-tager and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 10:05 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10088

What to do

Remove lovable-tager from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmlovable-tager	Affected =1.4.0 =1.4.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'lovable-tager' is a typosquatting malicious package impersonating the legitimate 'lovable-tagger' Vite plugin. Its ESM build contains obfuscated malicious code appended after the clean plugin code, which executes attacker-controlled code when loaded in a Node environment. This code can access require, filesystem, and network capabilities of the build host. The CommonJS build does not contain this payload, indicating the malicious code was added post-build and hidden via tab padding. Versions 1.4.0 and 1.4.1 are affected.

Impact

Execution of attacker-controlled code occurs in the Node.js process at plugin load time, allowing access to require, filesystem, and network capabilities on the build host. This can lead to arbitrary code execution, data exfiltration, or further compromise of the development environment. The malicious code is triggered simply by including the mistyped package in a Vite configuration.

Defensive guidance

Users should avoid installing or including the 'lovable-tager' package, especially versions 1.4.0 and 1.4.1. Verify package names carefully to prevent typosquatting attacks. Replace any usage of 'lovable-tager' with the legitimate 'lovable-tagger' package. Monitor dependency manifests and lockfiles for suspicious or unexpected packages. Since this is a malicious package published to npm, removing it from the dependency tree and reinstalling dependencies from trusted sources is recommended.

Summary

'lovable-tager' is a single-character typo-squatted npm package targeting users intending to use the legitimate 'lovable-tagger' Vite plugin. The ESM entry point (dist/index.js) includes a large amount of tab padding followed by an obfuscated Immediately Invoked Function Expression (IIFE) that, upon module load, exposes Node.js internals such as require, __dirname, and __filename, reconstructs Function via obfuscated means, and executes attacker-supplied code. The malicious payload is absent from the CommonJS build (dist/index.cjs), indicating it was smuggled into the published tarball after the build process. Any project that mistakenly includes 'lovable-tager' in its Vite configuration will execute this malicious code in the developer's Node process, potentially compromising the build environment.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 10:05 UTC

Technical details

References

Community reviews