@vite-tab/tabui@7.15.16

Analysis

@vite-tab/tabui@7.15.16 is a combosquat of the Vite build tool that ships a trojanized clone of the real Vite source code with an injected obfuscated JavaScript payload in bin/vite.js. The package claims to be Vite (author "Evan You", repository github[.]com/vitejs/vite) but includes @solana/web3.js, axios, socket[.]io-client, and form-data as devDependencies — the standard dependency set for Solana wallet drainers. The bin/vite.js entry point appends a heavily obfuscated self-executing payload after the legitimate Vite bootstrap code, using a custom string-shuffling decoder to capture require() and execute the drainer logic.