vite-pwa-config@1.1.1

Analysis

Combosquat package impersonating the legitimate vite-plugin-pwa library. On import, the package spawns a detached Node.js child process that fetches a remote payload from jsonkeeper[.]com (hxxps://www[.]jsonkeeper[.]com/b/FNOBS) via axios, then executes the fetched code using the Function constructor with access to require, enabling arbitrary remote code execution. The payload is fetched with a custom header (x-secret-key) and retries up to 5 times on failure. The package has no lifecycle hooks — the malicious code runs on import via the detached subprocess in dist/index.mjs.