The npm package react-next-vite version 1.2.9 impersonates the pino logger and contains malicious code that spawns a detached child process to fetch and execute remote JavaScript payloads. This payload is retrieved from a mutable IPFS gateway and executed with full access to the Node.js runtime via Function constructor and require. The package also uses base64-encoded URLs hidden in fake environment variables as a second-stage configuration channel, making it a fully weaponized dropper that activates when the module's default export is used.