Malicious code in basic-vite (npm)
The npm package basic-vite contained malicious code that executed automatically during installation, collecting and exfiltrating sensitive host identity data and system files to an attacker-controlled server.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed the malicious basic-vite package via npm.
- Ecosystems
- Attack vectors
- Affected entities
- basic-vitenpm package containing malicious preinstall script
The npm package basic-vite was published with malicious code embedded in its preinstall script. The package.json declared a preinstall: node index.js hook, causing the index.js script to execute automatically when developers ran npm install basic-vite.\n\nThe malicious script collected sensitive host identity information including hostname, username, home directory, DNS servers, current working directory, and package.json contents. It also read system files /etc/passwd and /etc/hosts. All collected data was exfiltrated via HTTPS POST requests to a hardcoded Burp Collaborator subdomain (md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com), an attacker-controlled out-of-band interaction host.\n\nThe package name suggested legitimate Vite-related functionality, but contained no such code—its sole purpose was install-time data exfiltration. The malicious package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- basic-vite
- Domains
- md3wko7hlcmvfsq16xh2higublhc53ts.oastify.com
Remediation
- Immediately uninstall basic-vite from all systems where it was installed
- Review npm install logs and audit history to identify when and where the package was installed
- Assume compromise of any system that installed the package; rotate credentials (SSH keys, API tokens, passwords) for affected hosts
- Inspect /etc/passwd and /etc/hosts files on affected systems for unauthorized modifications
- Monitor network traffic from affected systems for suspicious outbound HTTPS connections
- Update npm to the latest version and use npm audit to scan for other malicious packages
- Consider using npm package signing verification and private registry mirrors to prevent future malicious package installation
Sources
- GitHub Advisory GHSA-x36g-6hf7-wr48 · GitHub Advisory Database
Cite this entry
"Malicious code in basic-vite (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-basic-vite-npm-tfgirz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package