npm scope
@vite-js
LPM Firewall blocks 2 packages in the @vite-js npm scope. 1 has LPM's own review and is listed first.
Jul 14, 2026
@vite-js/vui@7.14.16
Remote code executionDirect source inspection confirms a concealed payload appended to the public CLI entrypoint and executed on every CLI invocation. The absence of an install hook does not mitigate this con...
Jul 8, 2026
@vite-js/ui@7.15.16
MalwareOpenSSF Malicious Packages via OSV confirms @vite-js/ui@7.15.16 as malicious (MAL-2026-7021): Malicious code in @vite-js/ui (npm)
Each card opens the package page with its evidence and every recorded version.