{"id":"MAL-2026-16474","revision":null,"records":[{"revision":"b78e508f3653483f827abf4dc3c2133c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-16474","aliases":[],"title":"Malicious code in vite-dev-launcher (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123)\nThe package presents as a Vite dev-server wrapper but its declared postinstall (`node./postinstall-run.cjs`) chains through `lib/gradle/lifecycle/postinstall-entry.cjs` and `instrumentation-registry.cjs` to base64+AES-256-GCM-decrypt an embedded ciphertext in `agent-bytecode.segments.cjs`. The AES key is derived from SHA-256 of a specific victim workspace's files (package.json, pnpm-workspace.yaml, vite-plugin-legacy-css.ts, scripts/gen-page-meta.cjs, scripts/git-tag.mjs, scripts/git-merge.mjs, src/router/routes.tsx, TAGLOG.md, index.html) plus a static pepper, and decryption only proceeds when the workspace digest matches a hardcoded `workspaceMaterialDigest` — environmental keying to a specific developer's repo that blocks sandbox analysis. The decrypted bytes are written to `~/.gradle/caches/transforms-3/8.7/instrumented/instrumented-jars/gradle-instrumentation-agent-8.7.0/instrumentation/instrumentation-agent-runtime.mjs` (a Gradle-cache path unrelated to a Vite/Node package) and launched via `child_process.spawn(nodeBin, [scriptPath, cwd, relay], {detached:true, stdio:'ignore', windowsHide:true})`. `lib/gradle/string-vault.cjs` hides configuration behind base64+XOR (key `gI8.7|tr`), exposing `c2Endpoint`, `apiRegister`, `apiTask`, `apiResult`, `apiFile`, `agentIdLeaf`, `relayEnvKey`, `tlsBypassEnvKey`, and `tlsRejectEnvKey` — the register/poll-task/return-result/file-transfer surface of a polling C2 agent, with a TLS-verification bypass toggle. The same activation chain is also reachable via `require('vite-dev-launcher')` (main → bin/cli.js → tooling-bootstrap.cjs → scheduleGradleDaemonSync → activateDaemonBridge) and via CLI invocation, giving the drop-and-exec redundant triggers on the targeted workspace.\n","state":0,"publishedAt":"2026-09-23T09:07:06+00:00","modifiedAt":"2026-09-23T09:30:04.9983405+00:00","affected":[{"ecosystem":"npm","name":"vite-dev-launcher","ranges":[],"versions":["2.9.4"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/vite-dev-launcher/v/2.9.4"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-16474","license":"OSV · upstream source license applies","key":"osv:MAL-2026-16474","identifiers":["MAL-2026-16474"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.4588707+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.458871+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-71a71be06903c0321f16f785da414a43cf171b11fafd14dad0e93850c58a221f","complete":true,"records":424812,"lastAttemptAt":"2026-11-12T19:16:36.4552812+00:00","lastSuccessAt":"2026-11-12T19:16:36.099661+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.4552812+00:00","snapshotPublishedAt":"2026-11-12T18:25:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-92f81c09e13d462186b63ad6d42bf56c","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:06.4872466+00:00","lastSuccessAt":"2026-11-12T19:19:06.482+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:06.482+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T19:18:40.2432846+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T19:18:40.2432846+00:00","lastSuccessAt":"2026-11-12T19:18:40.459652+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.4596522+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5542c4cfe5304160aa85412ba73639c8","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T19:19:05.6096222+00:00","lastSuccessAt":"2026-11-12T19:19:05.605+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:19:05.605+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0a16b7a0ad9e3cbe2c8193b3ff308e03491784410561da4c005974a7742a693a","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T19:18:40.1037842+00:00","lastSuccessAt":"2026-11-12T19:18:39.7950995+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.1037842+00:00","snapshotPublishedAt":"2026-11-12T18:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T19:16:36.615069+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:16:36.615069+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T19:18:40.2048041+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:40.2048041+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-558c98a923b6de17949b5b6cab024e22e2f0e3b948d91b9ed9bca029f7b91e19","complete":true,"records":231722,"lastAttemptAt":"2026-11-12T19:18:30.8566334+00:00","lastSuccessAt":"2026-11-12T19:18:29.2862915+00:00","error":null,"lastVerifiedAt":"2026-11-12T19:18:30.8566334+00:00","snapshotPublishedAt":"2026-11-12T18:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}