The vulnerability arises because [email protected] declares an optionalDependency 'vite-cleaning-tools' pointing to 'github:vite-plugins/vite-cleaning-tools' without a fixed commit SHA or tag. During installation, npm fetches the current HEAD of this GitHub repository and runs its code via a postinstall script that executes 'require("vite-cleaning-tools")' inside a try/catch block. This design allows dynamic code execution from an external mutable source outside the npm registry, enabling potential injection of malicious code by the repository maintainer or any actor who gains write access to the GitHub repository. Since the payload is fetched dynamically, npm registry scanning does not detect this malicious code.

This vulnerability allows arbitrary code execution on machines installing [email protected] due to the dynamic fetching and execution of code from an external GitHub repository. The attacker can modify the repository to run malicious code during npm install without needing to publish a new version to the npm registry. This can lead to compromise of developer environments or CI/CD pipelines that install this package.

No official patch or fix is currently documented. Users should avoid installing vite-plugin-cleaner version 4.1.3 or any versions that rely on mutable GitHub references for dependencies. Pinning dependencies to fixed commit SHAs or tags is recommended to prevent dynamic code execution. Monitor the vendor or repository for any official advisories or updates addressing this issue. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.