Malicious Code Injection in vite-dev-launcher: A Critical Vulnerability
Summary
MAL-2026-16474: Malicious code in vite-dev-launcher (npm). Affects vite-dev-launcher versions 2.9.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vite-dev-launcher is an npm package designed as a wrapper for the Vite development server, facilitating a streamlined development experience. It allows developers to leverage Vite's features while managing their development environment effectively. However, this package has been found to harbor a serious vulnerability that exposes users to potential malicious code execution.
Vulnerability Detail
The vulnerability originates from a malicious code embedded within the vite-dev-launcher package. During the post-installation process, the package executes a series of scripts that decrypt and execute hidden code, which is tailored to specific developer environments. This code can potentially compromise the integrity of the development environment, allowing unauthorized access and control. The malicious payload is obfuscated and only activates under certain conditions, making it difficult to detect through standard security measures.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vite-dev-launcherIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the vite-dev-launcher package until a patch is confirmed and applied. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The vite-dev-launcher package has been identified as containing malicious code that poses a significant risk to developers. It is imperative to update to the latest version to safeguard your development environment. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring your applications remain secure.
See every vulnerability recorded for vite-dev-launcher →
FAQ
vite-dev-launcher is an npm package that acts as a wrapper for the Vite development server, enhancing the development workflow for JavaScript applications.
The vulnerability allows malicious code to be executed within your development environment, potentially compromising sensitive information and system integrity.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can identify if your application is affected by this vulnerability.
Yes, you can temporarily avoid using the vite-dev-launcher package and look for alternative solutions until a secure version is released.
Detailed information about the vulnerability can be found in the Open Source Vulnerability database, as well as through security advisories related to the vite-dev-launcher package.
