All flagged patterns are benign: standard global detection, unicode regexes from lodash, WASM xxhash, atob/base64 for HTML entity decoding, AsyncFunction usage in the legitimate module runner, and fetch/exec calls for dev-server features (HMR, open-in-editor). This is the real Vite package with normal bundled dependencies; no malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
Vite is a native-ESM powered web dev build tool. It provides a CLI binary and build/dev scripts for bundling, type checking, and CSS processing using dependencies like rolldown, postcss, and lightningcss.
Capabilities
- Provides CLI binary via bin/vite.js
- Runs build and dev scripts
- Bundles client and node modules
- Includes type definitions and internal chunks
Data access
- Filesystem
- Environment variables
Network
- Remote fetch with process execution (per static findings)
- Dynamic module load with remote source (per static findings)
Static findings flag multiple instances of obfuscated files, remote fetches, and decoded payloads, which may stem from bundled or minified code in a legitimate build tool. Review the package source and consider sandboxing before use in sensitive environments.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (24)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in dist/node/chunks/build.js
Multiple obfuscation patterns in package/dist/node/chunks/build.js
Multiple obfuscation patterns in dist/node/chunks/dist.js
Multiple obfuscation patterns in package/dist/node/chunks/dist.js
Multiple obfuscation patterns in dist/node/module-runner.js
Multiple obfuscation patterns in package/dist/node/module-runner.js
File dist/node/chunks/build.js combines network access with process execution
File dist/node/chunks/build.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/node/chunks/build.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/chunks/build.js combines network access with process execution
File package/dist/node/chunks/build.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/chunks/build.js builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/module-runner.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File package/dist/node/module-runner.js decodes a base64/hex blob and passes it to an execution sink — a common way to hide a malicious payload.
File dist/client/bundledDevClient.mjs combines network access with process execution
File dist/client/bundledDevClient.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/client/bundledDevClient.mjs combines network access with process execution
File package/dist/client/bundledDevClient.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/client/client.mjs combines network access with process execution
File dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/client/client.mjs combines network access with process execution
File package/dist/client/client.mjs builds a dynamic import/require argument alongside network access — possible remote module loading.
File dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
File package/dist/node/index.d.ts builds a dynamic import/require argument alongside network access — possible remote module loading.
Files in package (70)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/vite