Malicious Package Affecting @vite-pro/vite-ui package, versions *
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-VITEPROVITEUI-18017538
- published19 Jul 2026
- disclosed18 Jul 2026
Introduced: 18 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the @vite-pro/vite-ui package.
Overview
@vite-pro/vite-ui is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan (RAT), enabling attackers to execute arbitrary commands, steal credentials and files, and establish persistent access to the affected system.
Note: The package impersonates legitimate Vite-related packages but is not affiliated with the Vite project or its maintainers.