Critical Malicious Code Vulnerability in vitejs-plugin-react-refresh
Summary
MAL-2025-6247: Malicious code in vitejs-plugin-react-refresh (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vitejs-plugin-react-refresh is an npm package designed to enhance the development experience for React applications by providing fast refresh capabilities. It allows developers to see changes in real-time without losing the component state. However, this package has been found to contain malicious code that compromises the security of any system where it is installed.
Vulnerability Detail
The vulnerability originates from the inclusion of embedded malicious code within the vitejs-plugin-react-refresh package. This code can fully compromise any computer that has the package installed, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code poses severe risks, as it may lead to data breaches and loss of control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vitejs-plugin-react-refreshIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to uninstall the affected package. You can do this by running the following command in your terminal: npm uninstall vitejs-plugin-react-refresh. After removal, ensure to rotate any secrets or keys that may have been compromised.
Conclusion
The vitejs-plugin-react-refresh package has been identified as containing malicious code that poses significant security risks. Users are advised to uninstall the package immediately and take necessary precautions to secure their systems. Regular monitoring for updates and vulnerabilities is essential to maintain software security.
See every vulnerability recorded for vitejs-plugin-react-refresh →
FAQ
vitejs-plugin-react-refresh is an npm package that allows for fast refresh in React applications, enabling developers to see changes in real-time.
A package containing malicious code can compromise the security of a system, allowing unauthorized access and potential data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the vitejs-plugin-react-refresh package and rotate any sensitive information that may have been compromised.
As of now, there is no patched version available. It is recommended to monitor the package for updates and remove it until a fix is released.
