MAL-2026-16474 Malicious code in vite-dev-launcher (npm)

The package presents as a Vite dev-server wrapper but its declared postinstall (node./postinstall-run.cjs) chains through lib/gradle/lifecycle/postinstall-entry.cjs and instrumentation-registry.cjs to base64+AES-256-GCM-decrypt an embedded ciphertext in agent-bytecode.segments.cjs. The AES key is derived from SHA-256 of a specific victim workspace's files (package.json, pnpm-workspace.yaml, vite-plugin-legacy-css.ts, scripts/gen-page-meta.cjs, scripts/git-tag.mjs, scripts/git-merge.mjs, src/router/routes.tsx, TAGLOG.md, index.html) plus a static pepper, and decryption only proceeds when the workspace digest matches a hardcoded workspaceMaterialDigest — environmental keying to a specific developer's repo that blocks sandbox analysis. The decrypted bytes are written to ~/.gradle/caches/transforms-3/8.7/instrumented/instrumented-jars/gradle-instrumentation-agent-8.7.0/instrumentation/instrumentation-agent-runtime.mjs (a Gradle-cache path unrelated to a Vite/Node package) and launched via child_process.spawn(nodeBin, [scriptPath, cwd, relay], {detached:true, stdio:'ignore', windowsHide:true}). lib/gradle/string-vault.cjs hides configuration behind base64+XOR (key gI8.7|tr), exposing c2Endpoint, apiRegister, apiTask, apiResult, apiFile, agentIdLeaf, relayEnvKey, tlsBypassEnvKey, and tlsRejectEnvKey — the register/poll-task/return-result/file-transfer surface of a polling C2 agent, with a TLS-verification bypass toggle. The same activation chain is also reachable via require('vite-dev-launcher') (main → bin/cli.js → tooling-bootstrap.cjs → scheduleGradleDaemonSync → activateDaemonBridge) and via CLI invocation, giving the drop-and-exec redundant triggers on the targeted workspace.