@vite-tab/tab@5.7.0

Analysis

@vite-tab/tab is a trojanized clone of the Vite build tool. The package claims the same author (Evan You), description, and repository URL as the real Vite, but ships an obfuscated payload appended to bin/vite.js that uses a custom string-shuffling algorithm to decode and execute a second-stage script. The devDependencies include @solana/web3.js, axios, socket[.]io-client, and form-data — a dependency stack associated with crypto-wallet credential theft. The same file also fetches remote content and executes it via the Function constructor, enabling a remote-code-execution dropper. When the package is installed and the vite binary is run, the obfuscated payload executes and can download and run arbitrary code from a remote server.