Why Vite reads /etc/shadow ???

[ENT108]

Describe the bug

I mean really, why?

11:02:20 PM [vite] Internal server error: ENOENT: no such file or directory, open '/etc/shadow' at async open (node:internal/fs/promises:638:25) at async Object.readFile (node:internal/fs/promises:1242:14) at async LoadPluginContext.load (file:///Users/xxx/Projects/xxx-app/node_modules/vite/dist/node/chunks/dep-BJP6rrE_.js:13451:11) at async EnvironmentPluginContainer.load (file:///Users/xxx/Projects/xxx-app/node_modules/vite/dist/node/chunks/dep-BJP6rrE_.js:47195:22) at async loadAndTransform (file:///Users/xxx/Projects/xxx-app/node_modules/vite/dist/node/chunks/dep-BJP6rrE_.js:40968:22) at async viteTransformMiddleware (file:///Users/xxx/Projects/xxx-app/node_modules/vite/dist/node/chunks/dep-BJP6rrE_.js:42478:24)

Reproduction

none

Steps to reproduce

I don't know how. It just pop up on me.

System Info

System:
    OS: macOS 15.3.2
    CPU: (8) arm64 Apple M1
    Memory: 93.53 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.14.0 - ~/.nvm/versions/node/v22.14.0/bin/node
    Yarn: 1.22.22 - ~/Projects/raceduck-app/node_modules/.bin/yarn
    npm: 10.9.2 - ~/.nvm/versions/node/v22.14.0/bin/npm
    Watchman: 2025.03.10.00 - /opt/homebrew/bin/watchman
  Browsers:
    Brave Browser: 134.1.76.74
    Chrome: 134.0.6998.166
    Chrome Canary: 137.0.7107.0
    Safari: 18.3.1
  npmPackages:
    @vitejs/plugin-react: ^4.3.4 => 4.3.4 
    @vitejs/plugin-react-swc: ^3.7.2 => 3.7.2 
    vite: 6.0.7 => 6.0.7

Used Package Manager

yarn

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[sapphi-red]

There could be many reasons. You may have a code that imports it or you may have a plugin that tries to read it.
The worst case scenario is that you have your dev server exposed to the internet (via --host or any proxy) and an attacker may be trying to attack you via reported vulns like GHSA-xcj6-pq6g-qj4x since you seems to be using an old version.