Malicious npm typosquats impersonating vite (EtherHiding blockchain-C2 loader): the packages @uw010010/vite-tree, @vite-tab/tab, @vite-ln/build-ts, @vite-mcp/vite-type, @vite-pro/vite-ui, @vitets/vite-ts, and @vite-ts/vite-ui impersonate the legitimate 'vite' package (copying its author 'Evan You', README, homepage vitejs.dev, repository vitejs/vite, and a 'vite' bin entry). Each appends an obfuscated loader to bin/vite.js that fetches an attacker-controlled payload via HTTP(S) GET + JSON-RPC POST to a blockchain RPC endpoint (EtherHiding), XOR-decodes it, and executes it via eval() and a detached, hidden child_process.spawn. The loader runs on every invocation of the hijacked 'vite' CLI (npx vite, npm run dev/build), yielding arbitrary remote code execution and persistence on any developer or build host. Installing any of these packages should be treated as full host compromise; rotate all secrets from a clean machine.