The 'viteplugiin' npm package impersonates the legitimate '@base44/viteplugin' by a one-character name variation. It contains a hostile payload in its dist/index.js file, which is executed at module load time due to the package's exports map directing '.' to this file. The payload uses obfuscated code involving Fisher-Yates string shuffles to reconstruct critical identifiers such as 'require', '__dirname', '__filename', 'undefined', and 'constructor'. It then reassigns these onto the global object and invokes the Function constructor on decoded strings, executing attacker-controlled JavaScript. Since Vite plugins are imported at config evaluation time, this causes the malicious code to run on any machine running Vite commands with this plugin included in vite.config.* files. The package metadata is suspicious, with an empty author, no repository or homepage, and a 'main' field pointing to a nonexistent file, while the exports map silently routes to the malicious code. The README and internal references mimic the legitimate plugin to evade detection.

The malicious code executes arbitrary JavaScript on developer and CI machines during Vite build commands, potentially compromising the build environment and any systems with access to those machines. This can lead to unauthorized code execution, data theft, or further compromise of development pipelines. The attack targets the software supply chain by masquerading as a legitimate plugin, increasing the risk of widespread impact if adopted.

No official patch or remediation is currently available for this malicious package. Users should avoid installing or using 'viteplugiin' version 1.0.28. Verify package names carefully to avoid typosquatting attacks and prefer official, verified packages. Remove any instances of 'viteplugiin' from project dependencies and vite.config.* files. Monitor for suspicious activity in development and CI environments. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.