The @uw010010/vite-tree package is a malicious npm typosquat of the vite package. It replicates vite's author, description, repository, and README to deceive users. Its binary includes obfuscated code that performs HTTP GET and JSON-RPC 2.0 POST requests to an attacker-controlled endpoint, XOR-decodes the response, evaluates the decoded payload, and spawns a detached background process running the same payload. This code executes whenever the vite binary from this package is run, enabling arbitrary attacker code execution and persistence on the victim's system.

Any developer who installs and runs the @uw010010/vite-tree package will have arbitrary attacker-controlled code executed on their machine. The malicious code runs on every invocation of the package's vite binary, allowing attackers to execute commands and maintain persistence via a hidden detached child process. This compromises the developer's environment and potentially any systems accessible from it.

No official patch or fix is available for this malicious package. The primary mitigation is to avoid installing or running the @uw010010/vite-tree package. Developers should verify package names carefully to avoid typosquatting attacks and use trusted sources such as the official vite package. If this package is found installed, it should be removed immediately and the environment inspected for signs of compromise.