Malicious code in vite-plugin-model (npm)
The npm package vite-plugin-model version 1.0.0 contains malicious code embedded in its CommonJS entrypoint. This code loads a V8 bytecode blob that executes attacker-controlled code by fetching and compiling a remote payload from a Pipedream webhook URL. The malicious behavior triggers immediately when the package is imported, enabling remote code execution on the installer's machine. The package's ESM module is clean, indicating targeted tampering of the CJS version. The package also uses undeclared dependencies consistent with attacker techniques to complete the execution chain.
AI Analysis
Technical Summary
The vite-plugin-model npm package version 1.0.0 has been found to include malicious code in its CommonJS entrypoint (dist/index.js). This entrypoint requires bytenode to load a V8 bytecode blob (dist/index.jsc) that contains obfuscated code including axios and Node.js internals. Upon import, it instantiates a hidden class that calls a method which fetches a remote payload from a Pipedream webhook URL, decodes it, and compiles it as a new Node module, executing arbitrary attacker-controlled code on the host machine. The ESM module (dist/index.mjs) is unaffected, and the package misrepresents its functionality, further indicating malicious intent. The presence of undeclared dependencies 'oubliette' and 'axios' supports the conclusion of a crafted attack chain via name squatting or dependency collision.
Potential Impact
Successful import of the malicious vite-plugin-model package version 1.0.0 results in remote code execution on the host machine where the package is installed. This allows an attacker to execute arbitrary code with the privileges of the user running the Node.js process, potentially leading to system compromise, data theft, or further malicious activity.
Mitigation Recommendations
No official patch or remediation is currently available for vite-plugin-model version 1.0.0. Users should immediately avoid installing or importing this package version. Remove any existing installations of vite-plugin-model version 1.0.0 from projects and dependency trees. Monitor package sources and advisories for updates or official fixes. Consider using alternative, verified packages for similar functionality.
Malicious code in vite-plugin-model (npm)
Description
The npm package vite-plugin-model version 1.0.0 contains malicious code embedded in its CommonJS entrypoint. This code loads a V8 bytecode blob that executes attacker-controlled code by fetching and compiling a remote payload from a Pipedream webhook URL. The malicious behavior triggers immediately when the package is imported, enabling remote code execution on the installer's machine. The package's ESM module is clean, indicating targeted tampering of the CJS version. The package also uses undeclared dependencies consistent with attacker techniques to complete the execution chain.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vite-plugin-model npm package version 1.0.0 has been found to include malicious code in its CommonJS entrypoint (dist/index.js). This entrypoint requires bytenode to load a V8 bytecode blob (dist/index.jsc) that contains obfuscated code including axios and Node.js internals. Upon import, it instantiates a hidden class that calls a method which fetches a remote payload from a Pipedream webhook URL, decodes it, and compiles it as a new Node module, executing arbitrary attacker-controlled code on the host machine. The ESM module (dist/index.mjs) is unaffected, and the package misrepresents its functionality, further indicating malicious intent. The presence of undeclared dependencies 'oubliette' and 'axios' supports the conclusion of a crafted attack chain via name squatting or dependency collision.
Potential Impact
Successful import of the malicious vite-plugin-model package version 1.0.0 results in remote code execution on the host machine where the package is installed. This allows an attacker to execute arbitrary code with the privileges of the user running the Node.js process, potentially leading to system compromise, data theft, or further malicious activity.
Mitigation Recommendations
No official patch or remediation is currently available for vite-plugin-model version 1.0.0. Users should immediately avoid installing or importing this package version. Remove any existing installations of vite-plugin-model version 1.0.0 from projects and dependency trees. Monitor package sources and advisories for updates or official fixes. Consider using alternative, verified packages for similar functionality.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10545
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a55ff6868715ace432f1cea
Added to database: 07/14/2026, 09:20:40 UTC
Last enriched: 07/14/2026, 09:34:14 UTC
Last updated: 07/30/2026, 18:16:04 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.