Vite 8.2.1 is a legitimate, widely-used build tool. All flagged patterns (Function('return this'), regex with \x00/\u0100, atob/Buffer.from base64, .exec on regexes, fetch calls, WASM xxhash64) are from bundled third-party deps (lodash, postcss-modules, parse5, entities) performing normal Unicode handling, CSS module parsing, HTML entity decoding, and source-map work. No malicious sinks, C2, exfil, or hidden payloads present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Vite is a native-ESM powered web dev build tool providing CLI, bundling, and development server capabilities via bin/vite.js and distributed build artifacts.
Capabilities
- Provides CLI entrypoint
- Runs build and dev scripts using rolldown and other tools
- Includes bundled client and node modules
- Contains obfuscated source files
- Remote fetch with process execution
- Dynamic module load with remote source
Data access
- Filesystem
- Environment variables
Network
- Makes outbound HTTP requests
Static findings flag multiple instances of obfuscated files, remote fetches with execution, decoded payloads, and dynamic remote module loads; as a widely used build tool these may reflect bundled dependencies or false positives but warrant review before installation.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (24)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in dist/node/chunks/build.js
Multiple obfuscation patterns in package/dist/node/chunks/build.js
Multiple obfuscation patterns in dist/node/chunks/dist.js
Multiple obfuscation patterns in package/dist/node/chunks/dist.js
Multiple obfuscation patterns in dist/node/module-runner.js
Multiple obfuscation patterns in package/dist/node/module-runner.js
File dist/node/chunks/build.js combines network access with process execution
File dist/node/chunks/build.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/node/chunks/build.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/chunks/build.js combines network access with process execution
File package/dist/node/chunks/build.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/chunks/build.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/module-runner.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/module-runner.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/client/bundledDevClient.mjs combines network access with process execution
File dist/client/bundledDevClient.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/client/bundledDevClient.mjs combines network access with process execution
File package/dist/client/bundledDevClient.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/client/client.mjs combines network access with process execution
File dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/client/client.mjs combines network access with process execution
File package/dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
Files in package (70)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/vite