vite-enhancer-config@1.2.1

Analysis

vite-enhancer-config@1.2.1 is a trojanized npm package that, immediately on import, silently fetches and executes remote code from a C2 server. The package combosquats the Vite ecosystem. On import, dist/index.js and dist/auto-init.js call executeBackgroundTask() via top-level await. The executor decodes a base64-payloaded C2 URL (hxxps://jsonkeeper[.]com/b/ADPEC) and authenticates with the header x-secret-key: _. It fetches the response via axios, extracts the "logger" field, and executes it using the Function constructor with full Node.js require access — enabling arbitrary second-stage payload delivery. All console output is suppressed to hide execution, and failures are retried up to 5 times with exponential backoff. The C2 host is jsonkeeper[.]com serving the URL path /b/ADPEC. The second-stage payload can perform credential theft, backdoor installation, or worm propagation.