# MAL-2026-16433: Malicious code in @vitemirrorte/element-plus-vite-cli (npm)


- **Type:** Malicious package
- **Package:** `@vitemirrorte/element-plus-vite-cli` (npm)
- **Published:** 23 Sep 2026

## What is MAL-2026-16433?

MAL-2026-16433 is a malicious package in @vitemirrorte/element-plus-vite-cli, published on 23 Sep 2026. 

### Official description

On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materialize lib/gradle/instrumentation/agent-runtime.source.mjs into ~/.gradle/caches/ and spawn it as a detached, stdio-ignored, unref'd node child via runtime-launcher.cjs, writing a PID file so the process persists beyond install. The agent polls the hardcoded lookalike C2 domain https://npmjs.it.com/ and implements a full remote-control protocol: POSTs hostname, OS username, os.type()/os.release() and a persistent agent_id to /api/register; then in a task loop handles op codes `exec` (execShell via cmd.exe or /bin/sh), `download` (reads arbitrary paths with fs.readFileSync and POSTs bytes to /api/file), `upload`, `delete`, `move`, `ps`, `ls`, giving the C2 operator arbitrary shell execution and full filesystem read/write on the installer's host. The C2 base can be overridden via a C2_SERVER_URL environment variable. Activation is gated by workspace-fingerprint.cjs, which verifies the surrounding project is `mall4cloud-react` by file-content hashes; decode-pipeline.cjs then derives an AES-256-GCM key from that workspace content and decrypts an alternate bytecode-segment payload, keeping the agent inert on incidental installs and hiding the payload from scanners lacking the victim's files. The npmjs.it.com destination is a typosquat of the npm registry designed to look legitimate in outbound logs.

## What should I do about MAL-2026-16433?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-16433 is a malicious package: @vitemirrorte/element-plus-vite-cli (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-16433/ (Markdown: https://insights.sbomify.com/MAL-2026-16433/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-16433

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-16433/
Summaries are generated and may contain mistakes; the official description above is the record.