The @vite-pro/vite-ui package is a malicious npm package designed to impersonate the legitimate vite package by copying author information, repository links, and documentation. It appends an obfuscated Immediately Invoked Function Expression (IIFE) to its CLI binary that uses a seeded Fisher-Yates shuffle and XOR decryption to hide remote endpoints and constants. Upon execution, it fetches a remote payload over HTTP, decrypts and evaluates it, then fetches a second payload which it runs as a detached, hidden child process. This behavior enables attackers to gain arbitrary code execution and maintain persistent background processes on developer machines each time the vite CLI is invoked via commands like vite, npx vite, or npm run dev/build. The obfuscation and execution techniques align with known blockchain command-and-control loader families.

This malicious package allows attackers to execute arbitrary code on developer machines and maintain persistent, hidden background processes. This compromises the security and integrity of the development environment, potentially leading to further system compromise or data exfiltration. The infection occurs whenever the vite CLI is run, making it highly persistent and stealthy.

No official patch or fix is available as this is a malicious package impersonating a legitimate one. The recommended mitigation is to avoid using the @vite-pro/vite-ui package entirely. Developers should verify package authenticity before installation, prefer official package sources, and remove any instances of this malicious package from their environments. Monitoring for unexpected child processes spawned by vite CLI executions may help detect infections.