vite-config-react@1.3.1

Analysis

vite-config-react@1.3.1 combosquats the Vite/React ecosystem as a config generator. While its entry point (src/index.js → createConfig) looks benign, plugins.js contains a side-effect import of './extras/config.js' that executes an IIFE at module-load time. That IIFE fetches a remote payload from jsonkeeper[.]com (hxxps://www[.]jsonkeeper[.]com/b/AAON3) using axios with custom headers and passes the response through new Function('require', code), granting the fetched payload full Node.js module access. This is a second-stage loader — the remote content can perform any action including credential exfiltration, backdoor installation, or worm propagation. The publisher (nathan333 / [account]