vite-config-optimizer@1.1.4

Analysis

vite-config-optimizer@1.1.4 is a second-stage dropper. Its postinstall hook in loader.js writes a hex-encoded dropper to a temp directory and spawns a detached, unref'd node process (stdio:ignore) that hex-decodes a URL, fetches a second-stage payload from hxxps://jsonkeeper[.]com/b/L435A, parses the response as JSON, writes the session/manifest field to a temp file, and require()s it to execute arbitrary code before cleaning up. The index.js is a decoy claiming to be a Vite plugin while actually implementing a mismatched WebpackCachePlugin, enabling arbitrary post-install code execution from a pastebin-style C2.