MAL-2026-10546

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5afbe0fab50b9582867bb208b6cfb20080849e27d27df79711f55e2db69f66bb)

The npm package 'viteplugiin' impersonates '@base44/viteplugin' via a one-character insertion (doubled 'i') and ships a hostile payload in dist/index.js, the entry resolved by the package's exports map. After the legitimate-looking plugin code, a large whitespace gap conceals an obfuscated stub that uses Fisher-Yates string shuffles with hardcoded seeds to reconstruct the identifiers 'require', '__dirname', '__filename', 'undefined', and 'constructor', reassigns require/__dirname/__filename onto the global object, obtains the Function constructor, and invokes it on two decoded string bodies — executing attacker-controlled JavaScript at module load time in the consumer's Vite build. Because Vite configs import plugins at config-evaluation time, adding this plugin to vite.config.* causes the payload to run on developer and CI machines during any Vite command. Provenance is consistent with an attack drop: empty author field, no repository/homepage, and package.json 'main' pointing at a nonexistent root index.js while the exports map silently routes '.' to the tampered dist/index.js. The README and internal resolveId targets reference the legitimate '@base44/vite-plugin' as cover.