vite-config-field@1.1.0

Analysis

Package impersonates the vite-plugin-pwa ecosystem by copying its README and package structure. When the Vite plugin's configFields() function is called during build, it spawns a detached child process (node ./dist/client/dev/reactopt.js) that fetches a second-stage payload from www[.]jsonkeeper[.]com/b/DDC6J using the custom header x-secret-key and executes it immediately via Function constructor with full require() access, enabling arbitrary remote code execution in the build context. The detached subprocess is spawned with stdio:ignore and unref'd so the install/build shows no visible output.