vite-json-pwa@1.1.1

Analysis

Combosquat of the legitimate @vite-pwa/json-config package. The package ships a file dist/client/dev/reactopt.js that, when loaded, fetches attacker-controlled code from hxxps://www[.]jsonkeeper[.]com/b/J7GQS and executes it via new Function("require", response.data.Cookie), giving the attacker arbitrary code execution in the installer's Node.js process. The main entry point (dist/index.mjs / dist/index.js) spawns this payload as a detached child process via spawn("node", [script, ...], {detached: true}) with stdio ignored, so it runs in the background.