Malicious code in vite-plugin-crypto (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54ee82c069dcdf259199f5844c6ff46be3020d79609ff7b7b8ebc82017c59b2c) vite-plugin-crypto@1.0.2 exposes a Vite plugin factory whose body concatenates three option fields — `secret`, `salt`, and `iv` — into a single string and passes it to `System.import(...)` from the `systemjs` runtime module loader, discarding the returned promise with `.then(() => {})`. Only `secret` is used by the advertised AES-GCM `encrypt()` path; `salt` and `iv` are declared on the options type but are absent from the documented options table and are unused by the real crypto code (which generates its own random salt/IV per call). The concatenated string is treated as a module specifier by SystemJS, which resolves URLs and executes fetched JavaScript, so whoever controls these option values obtains arbitrary JavaScript execution on the Vite build/dev host each time the config is loaded. Pulling in a browser-oriented dynamic module loader as the package's only runtime dependency, naming the concatenated input `derivedSecret`, and swallowing the promise frame the remote-loader call as a benign key-derivation step. Base64 decoding in dist/index.cjs and dist/index.js is used within the AES-GCM helper. The trigger fires at plugin construction during `vite build` / `vite dev`. ## Source: ghsa-malware (fdaf333e613f70df12ceaf378093d996a4bc1dd4df1a6350c4848a5de0fb83e7) Any computer that has this package installed or running sho
MAL-2026-17222
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17222
vite-plugin-crypto
Source reference: /affected/0/package/name
- Affected versions
- 1.0.2
Source reference:
/affected/0/versions1.0.6Source reference:
/affected/0/versions1.0.5Source reference:
/affected/0/versions1.0.1Source reference:
/affected/0/versions1.0.0Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vite-plugin-crypto",
"purl": "pkg:npm/vite-plugin-crypto",
"ecosystem": "npm"
},
"versions": [
"1.0.2",
"1.0.6",
"1.0.5",
"1.0.1",
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vite-plugin-crypto/MAL-2026-17222.json",
"indicators": {
"evidence_files": [
{
"path": "dist/index.cjs",
"tlsh": "be0274477df6546187b3b0a7b53fe9423638a5063400cb78bb6c87948f854a8d1b29ed",
"sha256": "e6ec0ae5781f3e77f3ea1f947e255c960bcb384c826a1d2d7626b7c8d0e7adfe"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33416 · Revision 1
- Added to Heist Feed
- Publisher date