MAL-2026-12004

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075) The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added preinstall dropper. package.json declares `preinstall: node lib/utils/index.js`, which uses child_process.spawn(process.execPath, [lib/utils/smtp-connection/index.js], {detached:true, stdio:['ignore','ignore','ignore']}).unref() to launch a detached, fully silenced child that survives beyond `npm install`. The spawned file is obfuscated with a custom basE91 string-array decoder; the decoded top-level async IIFE calls globalThis.fetch against a URL on api.jsonbin.io/v3/, parses the JSON response, and passes the `record.cookie` field to new Function('require', body)(require), executing attacker-controlled JavaScript with full `require` access on the installer at install time. api.jsonbin.io is a public, mutable, anonymous JSON-hosting service, so the executed payload can change at any time. Adjacent to the loader, lib/utils/smtp-connection/LICENSE is a 262KB file whose contents are a hex-encoded ~131KB opaque binary blob rather than license text, colocated with the loader as a staged secondary payload. The advertised package purpose has no relationship to the shipped SMTP source, providing cover for the injected dropper.