🛡️ MAL-2026-6988 — tab

Malicious code in @vite-tab/tab (npm)

Source: amazon-inspector

@vite-tab/tab republishes Vite's codebase under a different name while impersonating the upstream project: package.json declares bin: { vite: 'bin/vite.js' } (hijacking the vite command on $PATH), author: 'Evan You', repository: git+https://github.com/vitejs/vite.git, and homepage: https://vitejs.dev. Appended to bin/vite.js after the legitimate Vite bootstrap is a self-decoding string table (var _$_4445=(function(k,p){...})("...",4606094)) built via a Fisher-Yates-style scramble with \x25/\x23 substitution markers; all sensitive identifiers (https, get, request, JSON.parse, child_process, spawn, eval, host fragments) are referenced as indices into this table to defeat static review. At runtime the decoded routines perform an HTTPS GET followed by a JSON-RPC POST ({jsonrpc, method, params, id:1}) to a dynamically resolved hostname, base64-decode and XOR-decrypt the response, and pass it to eval(r); a second fetched payload is launched via child_process.spawn(..., {detached:true, windowsHide:true}), with a 30-second throttle. The fetch loop runs every time a developer invokes the hijacked vite command, giving the publisher arbitrary remote code execution on the developer machine with persistence via detached child processes. The remote-hostname JSON-RPC lookup makes the C2 endpoint resistant to static domain blocking.