MAL-2026-2913

    Dashboard / Malicious Package / MAL-2026-2913

    MAL-2026-2913

    Published: 16 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in vite-plugin-compress-plus (npm)

    Details: vite-plugin-compress-plus is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper[.]com/b/OTOAQ. Source: amazon-inspector (65e37bfe23d9bb451691cffd0333e0900835c8982785dde1908973adf2beaa7a) The package vite-plugin-compress-plus was found to contain malicious code.

    References:

    Affected packages

    Package

    Name: vite-plugin-compress-plus

    Purl: pkg:npm/vite-plugin-compress-plus

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2026-2913 | CVE-DB