vite-react-toolkit@1.0.1

Analysis

vite-react-toolkit@1.0.1 (published by [account] The file src/features/extras/config.js is a self-executing IIFE that fetches attacker-controlled JavaScript from hxxps://www[.]jsonkeeper[.]com/b/AAON3 using axios, then passes it through new Function("require", code) for arbitrary code execution. It is auto-imported as a module side-effect via src/features/plugins.js line 2 (import './extras/config.js'), meaning any require() or import of the package triggers the payload immediately — no lifecycle hooks needed. The payload retries up to 5 times and suppresses console.log to hide failure. The C2 host jsonkeeper[.]com allows the attacker to serve arbitrary updated payloads at any time.