vite-vue-path-map@1.0.2

One or more suspicious static signals were detected.

Consumer runs a Vite production build with the plugin; the injected code runs when visitors load the built application.

Compromises consumer-built sites, enables remote tracking, and can disrupt or deface application pages.

Build-time JavaScript bundle injection with delayed remote beacon and page replacement.

The exported Vite plugin modifies generated JavaScript during generateBundle. Unless an undocumented global MD5-based project/secret check passes, it injects a hidden image element that requests a base64-obscured remote URL after five to ten minutes. If that request fails, the injected handler replaces the entire document with a license-expiry notice and inserts zero-width characters into text nodes. This behavior is unrelated to generating Vue path maps and affects downstream applications.

Source inspection confirms intentional, concealed build-output injection and remote-triggered page replacement. This is concrete malicious behavior against consumers of the package.