MAL-2026-15818
Malicious code in vitest-cli-pro (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2) Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `record.cookie` value to `new Function(require)` for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing `npm install vitest-cli-pro`, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for vitest-cli-pro (npm). Pin to a known-safe version or switch to an alternative.