Malicious Package

Overview vite-plugin-js-support is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Exploit for CVE-2025-31486

Vite Path Traversal Lab CVE-2025-31486 !Open in GitHub Co...

Malicious code in vite-lightsparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10e940b9ceb264d366ff66c1c0dcdb57cf63b7a7664ff61db7b18a4523944e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6018 Malicious code in vite-lightsparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10e940b9ceb264d366ff66c1c0dcdb57cf63b7a7664ff61db7b18a4523944e4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6016 Malicious code in vite-postcss-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0637d37f1a6fc3f427c6a79a64570aa5d30ae202fb9a5a98031c38b4dbc27ed0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-postcss-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0637d37f1a6fc3f427c6a79a64570aa5d30ae202fb9a5a98031c38b4dbc27ed0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5965 Malicious code in vite-lightparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2be62813ca93fa71037568bc538e2ac083ad48faf1e5d0f362c4847d0f8a1b39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-lightparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2be62813ca93fa71037568bc538e2ac083ad48faf1e5d0f362c4847d0f8a1b39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-proc-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 097cf8f610d9121155696133687f0e50aa33c0716a29bb7fb0ebca8254f84e09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5968 Malicious code in vite-proc-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 097cf8f610d9121155696133687f0e50aa33c0716a29bb7fb0ebca8254f84e09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5966 Malicious code in vite-log-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae891068161d7e6889e4a12faa8fad3699025e42e4ed3f317e50f0506d517a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-log-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae891068161d7e6889e4a12faa8fad3699025e42e4ed3f317e50f0506d517a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-usageit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b967c2b3def62623ccbff0e7e878a7e995fe0dd101b98430c3d1f875cd4729c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5969 Malicious code in vite-usageit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b967c2b3def62623ccbff0e7e878a7e995fe0dd101b98430c3d1f875cd4729c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-postcss-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a86cf25e81b6e1f513cf67782d9ef778fe14ad1eba93f4a28adb2c1f63bfa965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5967 Malicious code in vite-postcss-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a86cf25e81b6e1f513cf67782d9ef778fe14ad1eba93f4a28adb2c1f63bfa965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2025-31125

Vite Exploit CVE-2025-31125 Description: Exploits path tr...

Cloudflare Vite plugin exposes secrets over the built-in dev server

Summary Note: originally posted on H1 but closed. Cross-posting over to here in abundance of caution instead of a public issue. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain...

GHSA-4PFG-2MW5-F8JX Cloudflare Vite plugin exposes secrets over the built-in dev server

Summary Note: originally posted on H1 but closed. Cross-posting over to here in abundance of caution instead of a public issue. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain...

Malicious code in vite-meta-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38fbb013e3df2485e72ad722dfab14b0295214d9f631913350b0eec0d658469a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...