The npm package '@vite-js/ui' is a malicious impersonation of the official 'vite' package. It mimics the legitimate package's metadata and structure but includes a heavily obfuscated payload that executes hidden code. This payload fetches and decodes remote code, executes it via eval, and spawns a detached process that persists beyond the CLI invocation, effectively creating a backdoor. The malicious code is present in versions 7.15.10 and 7.15.16 of '@vite-js/ui'.