Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the build runs, malware starts and opens a connection to an external server. This article covers an attack that forges a legitimate merge commit to plant a payload in vite.config.js . It is a generalized summary of what a real investigation found, and it…
The story begins with a user performing simple Git commands, `git pull` and `npm run build`, without any unusual behavior. However, during the `npm run build` process, malware is activated and connects to an external server. This attack involves forging a legitimate merge commit to inject malicious code into the `vite.config.js` file.
Several security vendors have reported this attack, which is part of a campaign targeting the npm and Vite ecosystem. The malware steals Git hosting credentials from the infected machine and uses them to force-push a poisoned commit to every branch of every repository it can reach. Only one file, the `vite.config.js`, is modified with obfuscated code that keeps the malware running by connecting to a command and control (C2) server.
The detection is difficult due to the location of the change, the use of whitespace, and the fact that it changes only two lines in the file. This technique, known as EtherHiding, uses public blockchain transactions to hide the C2 server address. Once the malware is in place, it can run arbitrary code received from the attacker, making it nearly impossible to determine the stolen information.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
