Vite 5.4.0 is legitimate. All flagged patterns are benign: source-map base64/vlq encoding, ANSI color escapes, HTML entity/Unicode parsing, debug logging, and path/URL helpers. No credential theft, C2, or hidden payloads.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Vite is a native-ESM powered web dev build tool that provides CLI-driven bundling, development server, and build capabilities using Rollup and esbuild.
Capabilities
- Provides CLI via bin/vite.js
- Runs build and dev scripts with Rollup/esbuild
- Contains multiple obfuscated source files
- Executes decoded payloads
- Performs remote fetches with process execution
- Dynamically loads modules from remote sources
Data access
- Filesystem
- Environment variables
Network
- Makes outbound HTTP requests
- Contains hardcoded public IP in network code
Manifest describes a standard build tool, but static findings report obfuscation, remote fetches, decoded payloads, and dynamic remote module loads that require review before use.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Obfuscated / hidden code
Encoded payloads decoded statically (without executing them) so you can see what they resolve to.
Multiple obfuscation patterns in dist/node/chunks/dep-D-7KCb9p.js
Multiple obfuscation patterns in package/dist/node/chunks/dep-D-7KCb9p.js
Security findings (27)
Static analysis rule matches, with the exact code that triggered them.
Version mismatch in types/package.json
Multiple obfuscation patterns in dist/node-cjs/publicUtils.cjs
Multiple obfuscation patterns in package/dist/node-cjs/publicUtils.cjs
Multiple obfuscation patterns in dist/node/chunks/dep-D-7KCb9p.js
Multiple obfuscation patterns in package/dist/node/chunks/dep-D-7KCb9p.js
Multiple obfuscation patterns in dist/node/chunks/dep-DvdjAuZF.js
Multiple obfuscation patterns in package/dist/node/chunks/dep-DvdjAuZF.js
Multiple obfuscation patterns in dist/node/runtime.js
Multiple obfuscation patterns in package/dist/node/runtime.js
File dist/node-cjs/publicUtils.cjs decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node-cjs/publicUtils.cjs decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/node/constants.js contains a hardcoded public IP (0000:0000:0000:0000:0000:0000:0000:0001) used in network code — review for hidden exfiltration or C2 endpoints.
File package/dist/node/constants.js contains a hardcoded public IP (0000:0000:0000:0000:0000:0000:0000:0001) used in network code — review for hidden exfiltration or C2 endpoints.
File dist/node/chunks/dep-DvdjAuZF.js combines network access with process execution
File dist/node/chunks/dep-DvdjAuZF.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/node/chunks/dep-DvdjAuZF.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/chunks/dep-DvdjAuZF.js combines network access with process execution
File package/dist/node/chunks/dep-DvdjAuZF.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/chunks/dep-DvdjAuZF.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/runtime.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/runtime.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/client/client.mjs combines network access with process execution
File dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/client/client.mjs combines network access with process execution
File package/dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
Known vulnerabilities (15)
Published CVEs / advisories affecting this version.
launch-editor vulnerable to command injection via the crafted request on Windows
vite: `server.fs.deny` bypass on Windows alternate paths
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Vite's server.fs.deny bypassed with /. for files under project root
vite allows server.fs.deny bypass via backslash on Windows
Vite's `server.fs.deny` is bypassed when using `?import&raw`
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
Websites were able to send any requests to the development server and read the response in vite
Vite bypasses server.fs.deny when using ?raw??
Vite allows server.fs.deny to be bypassed with .svg or relative paths
Vite middleware may serve files starting with the same name with the public directory
Vite's `server.fs` settings were not applied to HTML files
Files in package (60)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/vite