MAL-2026-16474
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123)
The package presents as a Vite dev-server wrapper but its declared postinstall (node./postinstall-run.cjs) chains through lib/gradle/lifecycle/postinstall-entry.cjs and instrumentation-registry.cjs to base64+AES-256-GCM-decrypt an embedded ciphertext in agent-bytecode.segments.cjs. The AES key is derived from SHA-256 of a specific victim workspace's files (package.json, pnpm-workspace.yaml, vite-plugin-legacy-css.ts, scripts/gen-page-meta.cjs, scripts/git-tag.mjs, scripts/git-merge.mjs, src/router/routes.tsx, TAGLOG.md, index.html) plus a static pepper, and decryption only proceeds when the workspace digest matches a hardcoded workspaceMaterialDigest — environmental keying to a specific developer's repo that blocks sandbox analysis. The decrypted bytes are written to ~/.gradle/caches/transforms-3/8.7/instrumented/instrumented-jars/gradle-instrumentation-agent-8.7.0/instrumentation/instrumentation-agent-runtime.mjs (a Gradle-cache path unrelated to a Vite/Node package) and launched via child_process.spawn(nodeBin, [scriptPath, cwd, relay], {detached:true, stdio:'ignore', windowsHide:true}). lib/gradle/string-vault.cjs hides configuration behind base64+XOR (key gI8.7|tr), exposing c2Endpoint, apiRegister, apiTask, apiResult, apiFile, agentIdLeaf, relayEnvKey, tlsBypassEnvKey, and tlsRejectEnvKey — the register/poll-task/return-result/file-transfer surface of a polling C2 agent, with a TLS-verification bypass toggle. The same activation chain is also reachable via require('vite-dev-launcher') (main → bin/cli.js → tooling-bootstrap.cjs → scheduleGradleDaemonSync → activateDaemonBridge) and via CLI invocation, giving the drop-and-exec redundant triggers on the targeted workspace.
- CWE-506 - The product contains code that appears to be malicious in nature.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "lib/gradle/instrumentation-registry.cjs",
"sha256": "a57335b5d877386d698b9af6967fe76208082bffd302cf3ae5a6a59f6fe8c0d6",
"tlsh": "ea5175eb7df3229a8f93528a6d6b881a2513c241325dcc61fd9c47680fc45694b32ff8"
},
{
"path": "lib/gradle/workspace-fingerprint.cjs",
"sha256": "0d68a48e4bfb865ec7c6d68cd44ac78af1241ce3cff3b6363eb256e8a13335ad",
"tlsh": "a561305b8cf6b2390966f5e969abd010b12e9517200efdc1b39c4990bfcb6584736b4c"
},
{
"path": "lib/gradle/string-vault.cjs",
"sha256": "3b2c99673d424c4da3a4a0ee48152481153eec561b2b8ba000d2a9c2272127ba",
"tlsh": "6321cc1dabb4f73c12a3b6b19853942e81dc2c04bb94a58f2785360c259ba2cc4f48c8"
},
{
"path": "lib/gradle/runtime-launcher.cjs",
"sha256": "f99b92168d1f1e956f2eed7fb8e87050ce93e12e19767a26e2d3b2f672fd3c32",
"tlsh": "3d3142ca59f1623583e2409deb5f941b7647c143371dd8d0f6ecc2c16fa672882729e5"
},
{
"path": "bin/cli.js",
"sha256": "979ebc68f5a09613d9c6bd17c0dc4b26a9a128436eea4a4efd1aed141eb09efc",
"tlsh": "9421ee19c4f9649a1566005a7e0e54337aeb40015344ab70d7edcb837fc8da803667ed"
}
],
"package_integrity": [
{
"filename": "vite-dev-launcher-2.9.4.tgz",
"hashes": {
"sha1": "f9f5833336087cfd9087eb98a364e00b410bded6",
"sha512_sri": "sha512-4cy1ESTGujYGA0xsWrDMyW80nrf77zvlBaRCQeWdVXNil5TJD2y/zzktScaUmB4VD8LQfig+F8gwOP9SDdovvQ=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "vite-dev-launcher"
},
"versions": [
"2.9.4"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-020483",
"import_time": "2026-09-23T09:20:27.700404541Z",
"modified_time": "2026-09-23T09:07:06Z",
"sha256": "9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123",
"source": "amazon-inspector",
"versions": [
"2.9.4"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123)\nThe package presents as a Vite dev-server wrapper but its declared postinstall (`node./postinstall-run.cjs`) chains through `lib/gradle/lifecycle/postinstall-entry.cjs` and `instrumentation-registry.cjs` to base64+AES-256-GCM-decrypt an embedded ciphertext in `agent-bytecode.segments.cjs`. The AES key is derived from SHA-256 of a specific victim workspace\u0027s files (package.json, pnpm-workspace.yaml, vite-plugin-legacy-css.ts, scripts/gen-page-meta.cjs, scripts/git-tag.mjs, scripts/git-merge.mjs, src/router/routes.tsx, TAGLOG.md, index.html) plus a static pepper, and decryption only proceeds when the workspace digest matches a hardcoded `workspaceMaterialDigest` \u2014 environmental keying to a specific developer\u0027s repo that blocks sandbox analysis. The decrypted bytes are written to `~/.gradle/caches/transforms-3/8.7/instrumented/instrumented-jars/gradle-instrumentation-agent-8.7.0/instrumentation/instrumentation-agent-runtime.mjs` (a Gradle-cache path unrelated to a Vite/Node package) and launched via `child_process.spawn(nodeBin, [scriptPath, cwd, relay], {detached:true, stdio:\u0027ignore\u0027, windowsHide:true})`. `lib/gradle/string-vault.cjs` hides configuration behind base64+XOR (key `gI8.7|tr`), exposing `c2Endpoint`, `apiRegister`, `apiTask`, `apiResult`, `apiFile`, `agentIdLeaf`, `relayEnvKey`, `tlsBypassEnvKey`, and `tlsRejectEnvKey` \u2014 the register/poll-task/return-result/file-transfer surface of a polling C2 agent, with a TLS-verification bypass toggle. The same activation chain is also reachable via `require(\u0027vite-dev-launcher\u0027)` (main \u2192 bin/cli.js \u2192 tooling-bootstrap.cjs \u2192 scheduleGradleDaemonSync \u2192 activateDaemonBridge) and via CLI invocation, giving the drop-and-exec redundant triggers on the targeted workspace.\n",
"id": "MAL-2026-16474",
"modified": "2026-09-23T09:07:06Z",
"published": "2026-09-23T09:07:06Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/vite-dev-launcher/v/2.9.4"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in vite-dev-launcher (npm)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.