Malicious Code Detected in vite-plugin-vue-extend-plugin: A Security Alert
Summary
MAL-2025-6968: Malicious code in vite-plugin-vue-extend-plugin (npm). Affects vite-plugin-vue-extend-plugin versions >= 1337.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vite-plugin-vue-extend-plugin is an npm package designed to enhance Vue.js applications by providing additional functionalities for extending Vue components. It is widely used in the development community for its ease of integration and utility. However, recent findings have revealed that this package communicates with a domain associated with malicious activities, raising significant security concerns for developers and users alike.
Vulnerability Detail
The vulnerability arises from the package's communication with a domain linked to malicious activities. This could potentially lead to data breaches, unauthorized access, or the execution of harmful code within applications that utilize this package. The issue was introduced in version 1337.0.0, making it critical for users of this version to take immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vite-plugin-vue-extend-pluginIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the vite-plugin-vue-extend-plugin package from your project until a secure version is available. You can do this by executing: npm uninstall vite-plugin-vue-extend-plugin.
Conclusion
The discovery of malicious code in vite-plugin-vue-extend-plugin poses a serious threat to developers and users. It is crucial to act promptly by updating the package or removing it from your project to safeguard your applications. Utilizing tools like Vulert can help monitor and alert you to such vulnerabilities in real-time.
See every vulnerability recorded for vite-plugin-vue-extend-plugin →
FAQ
vite-plugin-vue-extend-plugin is an npm package that enhances Vue.js applications by providing additional functionalities for extending Vue components.
The vulnerability involves the package communicating with a domain associated with malicious activities, which could compromise the security of applications using it.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to receive real-time alerts about vulnerabilities.
Yes, users are advised to update to the latest version of vite-plugin-vue-extend-plugin to mitigate the vulnerability.
As a temporary measure, you can uninstall the package until a secure version is released.
