Checkmarx flagged 7 Vite-lookalike npm packages as ViteVenom. What actually triggers (bin/vite.js, not install), the Tron/Aptos/BSC C2 chain, and why npm v12 allowScripts and release-age gates don't stop it.
Vitest's UI/api WebSocket skips Origin checks (CSWSH), so a malicious page can call saveTestFile and rerun to run code on your dev machine. Fixed in 1.6.1 / 2.1.9 / 3.0.5.
VoidZero, the developer of Vite, has released "Void", a full-stack web application platform built on Cloudflare, in early access. Deployment is completed with a single void deploy command, and no Cloudflare account is required.
Rust bundler Rolldown replaces esbuild and Rollup, unifying development and production builds. Achieved 40-64% reduction in actual projects such as Linear and Beehiiv.
One engineer plus AI reimplemented Next.js on Vite for about $1,100 in token cost. The result, vinext, shipped with 4.4x faster builds and a 57% smaller bundle, and is already running in production during its first week.
