The vite-vue-path-map npm package is advertised as a Vite plugin generating a local pathInfo.json map. However, its generateBundle hook appends obfuscated JavaScript to the main JavaScript chunk if a hidden MD5 license check comparing global variables fails. The appended code, stored as base64 constants and decoded at runtime, creates an invisible off-screen image element that sends a beacon request to https://plugin.gin-vue-admin.com/api/shopImage/view?name=logo.svg on every page load. If this request fails or returns a non-image response, an onerror handler executes document.open() and document.write() with a base64-decoded HTML defacement page in Chinese, replacing the developer's application in visitors' browsers. This remote-controlled injection, beaconing, and defacement are not disclosed in the package README and allow whoever controls the attacker's domain to remotely deface any site built with this plugin.

Sites built using vite-vue-path-map versions 1.0.0, 1.0.1, or 1.0.2 can have malicious JavaScript injected into their production builds. This code sends visitor data to an attacker-controlled domain and can remotely replace the entire web application with a defacement page. This compromises site integrity, availability, and user trust. The attacker has a remote kill-switch to activate or deactivate the malicious behavior at will.

No official patch or remediation is currently documented. Users should immediately stop using vite-vue-path-map versions 1.0.0, 1.0.1, and 1.0.2. Remove the package from builds and replace it with a trusted alternative. Audit existing production builds for injected malicious code and redeploy clean builds. Monitor for any unexpected outbound requests to plugin.gin-vue-admin.com and block this domain at network level if possible. Patch status is not yet confirmed — check the vendor advisory or official sources for updates.