The @vite-ts/vite-ui package version 6.44.1 mimics the legitimate vite package by cloning its README and metadata. It contains an obfuscated Immediately Invoked Function Expression (IIFE) that reconstructs strings and performs runtime HTTPS requests to an Ethereum block-explorer and JSON-RPC calls to an Ethereum node. The package retrieves hex-encoded JavaScript code from an attacker-controlled smart contract using an EtherHiding pattern, decodes it via XOR, and executes it both via eval and a detached child process running node. The fetched code is mutable and unsigned, allowing the attacker to execute arbitrary code on any system invoking the vite CLI from this package. Additional install-time scripts use curl and base64 decoding to further obfuscate malicious behavior.

Any user installing and running the vite CLI from @vite-ts/[email protected] is at risk of arbitrary code execution controlled by the attacker. The attacker can dynamically change the payload by updating the smart contract, potentially leading to full system compromise or further malicious activities. The malicious code runs with the privileges of the user executing the CLI, posing a significant security risk.

No official patch or remediation is currently available. Users should avoid installing or running @vite-ts/[email protected]. Verify the authenticity of npm packages before installation, preferring the legitimate vite package from trusted sources. Remove any installations of this malicious package immediately. Monitor for updates from the package maintainers or npm security advisories for any future remediation.