registry / Remote code execution / vite-pwa-config
vite-pwa-config
config json for Vite
This report shows the evidence for vite-pwa-config@1.1.4. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms a concrete remote-code-execution chain behind an exported API, not merely static similarity. Although it has no install hook, the stealthy detached remote payload execution is malicious behavior.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Consumer invokes `configJson` from the package entrypoint.
Impact
Remote code execution with the invoking user's permissions.
Mechanism
Detached child process remotely fetches and evaluates a payload.
Attack narrative
`configJson` invokes `getUseropt`, which spawns `dist/client/dev/viteopt.js` as a detached, unobserved Node process. On load, that helper fetches a value from `www.jsonkeeper.com` and passes it directly to `new Function`, then invokes it with `require`, giving a remote response arbitrary local module access and code execution under the developer account.
AI rationale
Source inspection confirms a concrete remote-code-execution chain behind an exported API, not merely static similarity. Although it has no install hook, the stealthy detached remote payload execution is malicious behavior.
Evidence
package.jsondist/index.jsdist/index.mjsdist/client/dev/viteopt.js
Network endpoints1
www.jsonkeeper.com/b/TUJAY
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `dist/index.js` exports `configJson`, which spawns a detached Node process.
- `dist/client/dev/viteopt.js` fetches `https://www.jsonkeeper.com/b/TUJAY` with Axios.
- `dist/client/dev/viteopt.js` executes fetched response data with `new Function(...); handler(require)`.
- The spawn is silent (`detached`, ignored stdio, `unref`) and occurs when `configJson` is invoked.
Evidence against
- `package.json` has no preinstall/install/postinstall lifecycle hook.
- The remote loader is not triggered by package installation or plain import; it is called by exported `configJson`.
- No credential harvesting, local secret-file reads, or exfiltration beyond fetching the remote payload was found.
- Other writes in `dist/index.mjs` generate PWA service-worker artifacts in the consumer project.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcedist/index.jsView file
1252// src/context.ts
L1253: var import_node_child_process = require("child_process");
L1254: var import_node_fs5 = require("fs");
High
48Cross-file remote execution chain: dist/index.js spawns dist/client/dev/viteopt.js; helper contains network access plus dynamic code execution.
L48: supportLevel = 0;
L49: if (globalVar.process && globalVar.process.env && globalVar.process.stdout) {
L50: const { FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM, COLORTERM } = globalVar.process.env;
...
L57: } else if ("CI" in globalVar.process.env && [
L58: "TRAVIS",
L59: "CIRCLECI",
...
L309: try {
L310: import.meta.hot.send('${DEV_READY_NAME}');
L311: } catch (e) {
...
L366: Configure "${prefix}.maximumFileSizeToCacheInBytes" to change the limit: the default value is 2 MiB.
L367: Check https://vite-pwa-org.netlify.app/guide/faq.html#missing-assets-from-sw-precache-manifest for more information.
L368: Assets exceeding the limit:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/index.jsView on unpkg · L48•matchType = normalized_sha256
matchedPackage = vite-pwa-config@1.1.2
matchedPath = dist/index.js
matchedIdentity = npm:dml0ZS1wd2EtY29uZmln:1.1.2
similarity = 1.000
summary = normalized source hash matched finalized malicious source
Findings
5 High2 Medium6 Low
HighChild Processdist/index.js
HighShell
HighCross File Remote Execution Contextdist/index.js
HighKnown Malware Source Similaritydist/index.js
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvaldist/client/dev/viteopt.js
LowWeak Cryptodist/index.mjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to vite-pwa-config@1.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing vite-pwa-config@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.