vite-vue-path-map
auto generate vue file path & component name map (pathInfo.json) for vite projects
This report shows the evidence for vite-vue-path-map@1.0.2. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms intentional, concealed build-output injection and remote-triggered page replacement. This is concrete malicious behavior against consumers of the package.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer runs a Vite production build with the plugin; the injected code runs when visitors load the built application.
Impact
Compromises consumer-built sites, enables remote tracking, and can disrupt or deface application pages.
Mechanism
Build-time JavaScript bundle injection with delayed remote beacon and page replacement.
Attack narrative
The exported Vite plugin modifies generated JavaScript during generateBundle. Unless an undocumented global MD5-based project/secret check passes, it injects a hidden image element that requests a base64-obscured remote URL after five to ten minutes. If that request fails, the injected handler replaces the entire document with a license-expiry notice and inserts zero-width characters into text nodes. This behavior is unrelated to generating Vue path maps and affects downstream applications.
AI rationale
Source inspection confirms intentional, concealed build-output injection and remote-triggered page replacement. This is concrete malicious behavior against consumers of the package.
Evidence
index.min.jspackage.jsonREADME.mdsrc/view/**/*.vuesrc/plugin/**/*.vueVite emitted JavaScript chunksuser-supplied pathInfo.json output path
Network endpoints1
plugin.gin-vue-admin.com/api/shoopImage/view?name=logo.svg
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.min.js injects code into Vite JS chunks in generateBundle.
- Injected code delays 5–10 minutes before loading an obscured remote image URL.
- On remote-load failure it overwrites the page with a Chinese license-expiry notice.
- The fallback obfuscates page text using zero-width characters.
- Injection is hidden behind a global project/secret MD5 check, not documented plugin behavior.
Evidence against
- package.json has no install lifecycle hook.
- README.md documents legitimate Vue-path mapping and development watching.
Behavioral surface
CryptoFilesystem
HighEntropyStringsMinifiedTrivial
Source & flagged code
2 flagged · loading sourceindex.min.jsView file
1import h from"fs";import u from"path";import Z from"crypto";import j from"chokidar";const v=t=>t.replace(/(^\w|-\w)/g,W),W=t=>t.replace(/-/,"").toUpperCase(),g=(t,e=[])=>(h.readdir...
L2: ${e}
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
index.min.jsView on unpkg · L11import h from"fs";import u from"path";import Z from"crypto";import j from"chokidar";const v=t=>t.replace(/(^\w|-\w)/g,W),W=t=>t.replace(/-/,"").toUpperCase(),g=(t,e=[])=>(h.readdir...
L2: ${e}
Low
Findings
1 High4 Low
HighBase64 Obscured Urlindex.min.js
LowScripts Present
LowWeak Cryptoindex.min.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to vite-vue-path-map@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing vite-vue-path-map@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.