vite-tsconfig@1.1.2
Malicious code in vite-tsconfig (npm)
Analysis
vite-tsconfig@1.1.2 ships a remote-code-execution implant in lib/mapProps.js. When a developer uses the configJson() middleware, it spawns a detached Node.js subprocess (detached:true, stdio:ignore, child.unref()) that fetches arbitrary code from jsonkeeper[.]com/b/LVKHJ and executes it via new Function("require", code) — giving the attacker full require() access. The TypeScript source src/mapProps.ts is deliberately omitted from the tarball (only the compiled JS and .d.ts are shipped). Publisher uses a throwaway email ([account]). This is a stealthy second-stage RCE loader that activates on API usage, not install.
- analyzed by
- Leitwacht
- first seen
- Jun 11, 2026, 05:26 PM
- analyzed
- Jun 11, 2026, 05:27 PM
Related advisories
- express-initial@12.1.7
- node-pino@2.3.2
- linux-ci-utils@1.0.0
- mountly@0.2.2
- mountly-tailwind@0.1.3
- postcss-processor-utils@1.0.3
- nebulaai-sdk@1.0.0
- chromatitle@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.