The @vitets/vite-ts npm package (version 1.5.10) is a malicious package designed to impersonate the legitimate Vite project by copying metadata and naming its CLI binary 'vite'. The package's bin/vite.js file contains an obfuscated payload that reconstructs strings via numeric indices to hide critical identifiers such as 'require', 'child_process', 'spawn', and 'eval'. Upon execution, it performs HTTPS GET and JSON-RPC POST requests to remote hosts, retrieves a key from a second endpoint, XOR-decodes the response, and executes the resulting code via eval. Additionally, it spawns a detached background process to run the malicious code, enabling arbitrary code execution on the developer's machine without any integrity verification of the fetched code. The dist/ bundle also includes base64 and Buffer decoding routines consistent with handling further obfuscated payloads. This behavior allows the attacker to execute arbitrary commands on any system running this package version.

This malicious package enables arbitrary code execution on the developer's machine every time the vite CLI is invoked. Because the package fetches and executes remote code without integrity checks, an attacker can run any code, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation techniques used make detection by static analysis difficult, increasing risk of unnoticed compromise.

No official patch or remediation is currently documented for this malicious package. Users should immediately uninstall @vitets/vite-ts version 1.5.10 and avoid installing packages from untrusted sources. Verify package authenticity by checking the official Vite project and its npm namespace (@vitejs). Because this is a malicious package impersonating a legitimate one, do not run the vite CLI from this package. Monitor for any signs of compromise if this package was installed and executed. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.