plugin-react-vite@2.1.2

Analysis

plugin-react-vite@2.1.2 is a remote-code-execution dropper. Its main entry point (index.js) fetches a payload from hxxp://31[.]97[.]137[.]157:45000/icons/116 (raw IP, non-standard port, custom header "bearrtoken: logo") and executes the response's `credits` field via the Function constructor with full Node.js context (require, process, Buffer, module), so the actual malicious code is served remotely and never shipped in the package. The package name impersonates the Vite React plugin ecosystem and its README is a mismatched copy-paste from an unrelated package. C2: 31[.]97[.]137[.]157:45000, path /icons/116.