{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/gradle/instrumentation-registry.cjs","sha256":"a57335b5d877386d698b9af6967fe76208082bffd302cf3ae5a6a59f6fe8c0d6","tlsh":"ea5175eb7df3229a8f93528a6d6b881a2513c241325dcc61fd9c47680fc45694b32ff8"},{"path":"lib/gradle/workspace-fingerprint.cjs","sha256":"0d68a48e4bfb865ec7c6d68cd44ac78af1241ce3cff3b6363eb256e8a13335ad","tlsh":"a561305b8cf6b2390966f5e969abd010b12e9517200efdc1b39c4990bfcb6584736b4c"},{"path":"lib/gradle/string-vault.cjs","sha256":"3b2c99673d424c4da3a4a0ee48152481153eec561b2b8ba000d2a9c2272127ba","tlsh":"6321cc1dabb4f73c12a3b6b19853942e81dc2c04bb94a58f2785360c259ba2cc4f48c8"},{"path":"lib/gradle/runtime-launcher.cjs","sha256":"f99b92168d1f1e956f2eed7fb8e87050ce93e12e19767a26e2d3b2f672fd3c32","tlsh":"3d3142ca59f1623583e2409deb5f941b7647c143371dd8d0f6ecc2c16fa672882729e5"},{"path":"bin/cli.js","sha256":"979ebc68f5a09613d9c6bd17c0dc4b26a9a128436eea4a4efd1aed141eb09efc","tlsh":"9421ee19c4f9649a1566005a7e0e54337aeb40015344ab70d7edcb837fc8da803667ed"}],"package_integrity":[{"filename":"vite-dev-launcher-2.9.4.tgz","hashes":{"sha1":"f9f5833336087cfd9087eb98a364e00b410bded6","sha512_sri":"sha512-4cy1ESTGujYGA0xsWrDMyW80nrf77zvlBaRCQeWdVXNil5TJD2y/zzktScaUmB4VD8LQfig+F8gwOP9SDdovvQ=="}}]}},"package":{"ecosystem":"npm","name":"vite-dev-launcher"},"versions":["2.9.4"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020483","import_time":"2026-09-23T09:20:27.700404541Z","modified_time":"2026-09-23T09:07:06Z","sha256":"9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123","source":"amazon-inspector","versions":["2.9.4"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123)\nThe package presents as a Vite dev-server wrapper but its declared postinstall (`node./postinstall-run.cjs`) chains through `lib/gradle/lifecycle/postinstall-entry.cjs` and `instrumentation-registry.cjs` to base64+AES-256-GCM-decrypt an embedded ciphertext in `agent-bytecode.segments.cjs`. The AES key is derived from SHA-256 of a specific victim workspace's files (package.json, pnpm-workspace.yaml, vite-plugin-legacy-css.ts, scripts/gen-page-meta.cjs, scripts/git-tag.mjs, scripts/git-merge.mjs, src/router/routes.tsx, TAGLOG.md, index.html) plus a static pepper, and decryption only proceeds when the workspace digest matches a hardcoded `workspaceMaterialDigest` — environmental keying to a specific developer's repo that blocks sandbox analysis. The decrypted bytes are written to `~/.gradle/caches/transforms-3/8.7/instrumented/instrumented-jars/gradle-instrumentation-agent-8.7.0/instrumentation/instrumentation-agent-runtime.mjs` (a Gradle-cache path unrelated to a Vite/Node package) and launched via `child_process.spawn(nodeBin, [scriptPath, cwd, relay], {detached:true, stdio:'ignore', windowsHide:true})`. `lib/gradle/string-vault.cjs` hides configuration behind base64+XOR (key `gI8.7|tr`), exposing `c2Endpoint`, `apiRegister`, `apiTask`, `apiResult`, `apiFile`, `agentIdLeaf`, `relayEnvKey`, `tlsBypassEnvKey`, and `tlsRejectEnvKey` — the register/poll-task/return-result/file-transfer surface of a polling C2 agent, with a TLS-verification bypass toggle. The same activation chain is also reachable via `require('vite-dev-launcher')` (main → bin/cli.js → tooling-bootstrap.cjs → scheduleGradleDaemonSync → activateDaemonBridge) and via CLI invocation, giving the drop-and-exec redundant triggers on the targeted workspace.\n","id":"MAL-2026-16474","modified":"2026-09-23T09:07:06Z","published":"2026-09-23T09:07:06Z","references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vite-dev-launcher/v/2.9.4"}],"schema_version":"1.7.4","summary":"Malicious code in vite-dev-launcher (npm)"}