MAL-2026-6988

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (95af865d1cf7d45f2b4c2a73eebcfcd1a1a6aba9a36f33bf8256ef4d7235903c) `@vite-tab/tab` republishes Vite's codebase under a different name while impersonating the upstream project: `package.json` declares `bin: { vite: 'bin/vite.js' }` (hijacking the `vite` command on $PATH), `author: 'Evan You'`, `repository: git+https://github.com/vitejs/vite.git`, and `homepage: https://vitejs.dev`. Appended to `bin/vite.js` after the legitimate Vite bootstrap is a self-decoding string table (`var _$_4445=(function(k,p){...})("...",4606094)`) built via a Fisher-Yates-style scramble with `\x25`/`\x23` substitution markers; all sensitive identifiers (`https`, `get`, `request`, `JSON.parse`, `child_process`, `spawn`, `eval`, host fragments) are referenced as indices into this table to defeat static review. At runtime the decoded routines perform an HTTPS GET followed by a JSON-RPC POST (`{jsonrpc, method, params, id:1}`) to a dynamically resolved hostname, base64-decode and XOR-decrypt the response, and pass it to `eval(r)`; a second fetched payload is launched via `child_process.spawn(..., {detached:true, windowsHide:true})`, with a 30-second throttle. The fetch loop runs every time a developer invokes the hijacked `vite` command, giving the publisher arbitrary remote code execution on the developer machine with persistence via detached child processes. The remote-hostname JSON-RPC lookup makes the C2 endpoint resistant to static domain blocking.