MalwarePublished 10 Jul 2026Updated 1 Sep 2026

mdb-vite (npm) · Malicious Code

Affects mdb-viteSource GCVE Database

Malicious package : remove mdb-vite and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 18:31 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10144

What to do

Remove mdb-vite from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmmdb-vite	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'mdb-vite' contains malicious code that fetches and executes attacker-controlled JavaScript code with full Node.js privileges on any system that imports and runs its default export. The package masquerades as a legitimate SDK related to Polymarket and Vite tooling but instead performs a remote code execution via dynamic evaluation of fetched code. This allows an attacker to deliver arbitrary payloads, steal credentials, maintain persistence, or compromise downstream systems.

Impact

Systems that install or run the 'mdb-vite' package are subject to arbitrary remote code execution by an attacker, enabling full system compromise. This includes potential credential theft, persistent backdoors, and further compromise of connected systems. The attacker gains the same privileges as the Node.js process executing the package, which can be extensive. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and rotated immediately.

Defensive guidance

The package should be immediately removed from all systems. Because the package executes attacker-controlled code with full privileges, any affected system should be considered fully compromised. All secrets, credentials, and keys stored on the system must be rotated from a secure, uncompromised environment. Additional forensic analysis and remediation may be necessary to ensure no persistent backdoors remain.

Summary

The 'mdb-vite' npm package's default export function 'getPlugin' performs an obfuscated HTTPS fetch to a remote URL, retrieving JavaScript code from the 'credits' field of the response. This code is then executed dynamically using 'new Function' with full Node.js context, including access to 'require', 'module', 'process', and other globals. This results in arbitrary remote code execution with the privileges of the Node.js process running the package. The package uses misleading metadata and naming to disguise its malicious intent. Any system running this package is effectively fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 18:31 UTC

Technical details

References

Community reviews