The npm package 'viteplugiin' is a malicious package impersonating the legitimate '@base44/viteplugin' by inserting an extra 'i' in its name. It contains obfuscated code that executes attacker-controlled JavaScript during module load, triggered when used in Vite configuration files. This causes the malicious payload to run on developer and CI machines whenever any Vite command is executed. The package exhibits typical signs of a supply chain attack, including an empty author field, no repository or homepage, and misleading package metadata. Only version 1.0.28 of 'viteplugiin' is known to be affected.