MalwarePublished 16 Jun 2026Updated 10 Jul 2026

vite-config-field (npm) · Malicious Code

Affects vite-config-fieldSource GCVE Database

Malicious package : remove vite-config-field and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5936

What to do

Remove vite-config-field from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvite-config-field	Affected 1.1.0 – 1.1.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8e5dabbc9cf746e153391fbe76f4dc54f9bccb9f7fd467d5b80d07c84ab1fb58) vite-config-field@1.1.0 impersonates the legitimate vite-plugin-pwa package (README copies its banner/badges, funding field points at antfu's GitHub Sponsors, and the package re-exports VitePWA alongside the attacker-introduced configFields helper). The ESM entry dist/index.js exposes a configFields(userOpt) function which, when called from a Vite config (as the README instructs), detached-spawns `node dist/client/dev/reactopt.js` with stdio ignored and unref'd to hide the child from the developer. dist/client/dev/reactopt.js (lines 21-23) fetches https://www.jsonkeeper.com/b/DDC6J with header `x-secret-key: _`, reads the response's `data.Cookie` field, and executes it via `new Function.constructor('require', params); handler(require)` — granting the attacker arbitrary Node code execution with require injected, on any developer or build machine that imports the package and invokes configFields(). The CJS entry dist/index.cjs intentionally omits this payload, so reviewers inspecting `main` see clean code while modern ESM toolchains that resolve via `module`/`import` get the dropper. The fetched payload host (jsonkeeper.com) is a mutable public paste-bin-like service, so the executed code can change at any time. ## Source: ghsa-malware (9f3a3a13cccda063a98a0048217c3db7c09659ba943668736368cfff187ad4b4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any developer or build machine that installs and invokes the configFields() function from vite-config-field versions 1.1.0 to 1.1.3 is at risk of arbitrary remote code execution. This leads to full system compromise, including potential theft of secrets and credentials. The attacker gains persistent and stealthy control, as the malicious code runs detached and hidden from standard output. Removal of the package alone does not guarantee remediation due to possible persistence mechanisms installed by the attacker.

Defensive guidance

Users should immediately remove vite-config-field versions 1.1.0 through 1.1.3 from their environments. All secrets and keys on affected machines should be rotated from a separate, trusted system. Due to the high risk of full system compromise, affected machines should be considered untrusted and rebuilt if possible. Monitor for any suspicious detached Node.js processes or network connections to jsonkeeper.com. Avoid invoking the configFields() function from this package.

Summary

vite-config-field@1.1.0 through 1.1.3 is a malicious npm package that impersonates vite-plugin-pwa by copying its README banners and funding links. Its ESM entry point exports a configFields(userOpt) function that, when called, spawns a detached Node.js process executing code fetched from a mutable public paste service (jsonkeeper.com). This code is executed via a dynamic Function constructor with require injected, granting attackers arbitrary Node.js code execution on any machine importing and invoking this function. The CommonJS entry point is clean to evade detection by reviewers. The mutable nature of the fetched payload allows attackers to change the executed code at any time, increasing risk.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Jul 2026, 00:07 UTC

Technical details

References

Community reviews