@asenfotech/unplugin-element-plusnpm
@asenfotech/unplugin-element-plus is a confirmed malicious npm package (MAL-2026-16318) that opens a backdoor for remote access (malicious versions 2.9.3, 2.9.5). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in @asenfotech/unplugin-element-plus (npm)
What this malware does
Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time dropper. The declared postinstall hook (postinstall-run.cjs) chains through lifecycle/instrumentation modules that assemble ~90 base64 chunks in agent-bytecode.segments.cjs, decode them via Buffer.from(joined, 'base64'), write the result to /.gradle/caches/transforms-3/8.7/instrumented/.../instrumentation-agent-runtime.mjs (a path masquerading as a Gradle instrumentation cache), and spawn a detached, hidden node process on it (spawn(nodeBin, [scriptPath,...], { detached: true, stdio: 'ignore', windowsHide: true }); child.unref()). The decoded payload is a full command-and-control agent: it POSTs hostname, username, and OS type/release plus a persisted agent UUID (/.gradle-cache/.aid) to https://npmjs.it.com/api/register (a typosquat of npmjs.com), long-polls https://npmjs.it.com/api/task/<id>, and executes operator commands including exec (spawns /bin/sh or cmd.exe with attacker-supplied command), ls, download (POSTs arbitrary local file contents to /api/file/<agent>/<task>), upload (writes attacker-supplied bytes to the filesystem), delete, ps, and move; results are POSTed back to the same host. TLS verification for C2 traffic can be disabled via C2_TLS_INSECURE. The package's main entry re-triggers the same drop-and-launch chain on require() through tooling-bootstrap.cjs and lib/gradle/gradle-daemon-sync.cjs, gated on a hardcoded workspace-marker allowlist (src/pages/GameAggregator/GameAggrBusinessPage/index.tsx, src/master/src/router/routes.tsx, etc.), so the backdoor also fires at import time inside a specific targeted monorepo. The gradle/instrumentation directory naming has no relation to the declared Vue-resolver purpose and pairs with the chunked-base64 encoding to conceal the payload.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @asenfotech/unplugin-element-plus (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @asenfotech/unplugin-element-plus across your stack and pipelines.
If you installed it — respond
@asenfotech/unplugin-element-plus establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @asenfotech/unplugin-element-plus was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @asenfotech/unplugin-element-plus before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @asenfotech/unplugin-element-plus-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.