viteplugiin@1.0.28

Analysis

viteplugiin@1.0.28 is a typosquat of the legitimate @base44/viteplugin Vite plugin. The package ships a legitimate-looking Vite plugin in its source TypeScript, but the compiled dist/index.js has a large obfuscated payload injected at the end that is not present in the source. The obfuscated code uses multi-layer string deobfuscation (Fisher-Yates shuffle-based decoding), sets global.o='*8-0', assigns require/__dirname/__filename to the global scope, and executes a deeply nested IIFE. The package has no install lifecycle hooks, so the payload activates when the package is imported as a Vite plugin in a project's vite.config.ts.