Malicious code in basic-vite (npm)
The npm package basic-vite contained malicious code that executed automatically during installation, collecting and exfiltrating sensitive host identity data and system files to an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious basic-vite package via npm.
- Ecosystems
- Attack vectors
- Affected entities
- basic-vitenpm package containing malicious preinstall script
The npm package basic-vite was published with malicious code embedded in its preinstall script. The package.json declared a preinstall: node index.js hook, causing the index.js script to execute automatically when developers ran npm install basic-vite.\n\nThe malicious script collected sensitive host identity information including hostname, username, home directory, DNS servers, current working directory, and package.json contents. It also read system files /etc/passwd and /etc/hosts. All collected data was exfiltrated via HTTPS POST requests to a hardcoded Burp Collaborator subdomain (md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com), an attacker-controlled out-of-band interaction host.\n\nThe package name suggested legitimate Vite-related functionality, but contained no such code—its sole purpose was install-time data exfiltration. The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- basic-vite
- Domains
- md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com
Remediation
- Immediately uninstall basic-vite from all systems where it was installed
- Review npm install logs and audit history to identify when and where the package was installed
- Assume compromise of any system that installed the package; rotate credentials (SSH keys, API tokens, passwords) for affected hosts
- Inspect /etc/passwd and /etc/hosts files on affected systems for unauthorized modifications
- Monitor network traffic from affected systems for suspicious outbound HTTPS connections
- Update npm to the latest version and use npm audit to scan for other malicious packages
- Consider using npm package signing verification and private registry mirrors to prevent future malicious package installation
Sources
- GitHub Advisory GHSA-x36g-6hf7-wr48 · GitHub Advisory Database
Cite this entry
"Malicious code in basic-vite (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-basic-vite-npm-tfgirz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @rentwise/common
Malware was discovered in the npm package @rentwise/common. Systems with this package installed are considered fully compromised and require immediate remediation including secret rotation and package removal.
npmCompromised package - containedcritical
Malware in @nasddatax/common
Malware was discovered in the npm package @nasddatax/common. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in @voxepay/checkout
The npm package @voxepay/checkout contained malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in @afasinatickets/common
The npm package @afasinatickets/common contains malware that grants full system compromise to an outside entity. All systems with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different computer.
npmCompromised package