vite-tsconfig@1.1.2

Analysis

vite-tsconfig@1.1.2 ships a remote-code-execution implant in lib/mapProps.js. When a developer uses the configJson() middleware, it spawns a detached Node.js subprocess (detached:true, stdio:ignore, child.unref()) that fetches arbitrary code from jsonkeeper[.]com/b/LVKHJ and executes it via new Function("require", code) — giving the attacker full require() access. The TypeScript source src/mapProps.ts is deliberately omitted from the tarball (only the compiled JS and .d.ts are shipped). Publisher uses a throwaway email ([account]). This is a stealthy second-stage RCE loader that activates on API usage, not install.