vitest-preview-pro-all

{"modified":"2026-08-06T12:30:54Z","published":"2026-08-06T12:30:54Z","schema_version":"1.7.4","id":"MAL-2026-13405","summary":"Malicious code in vitest-preview-pro-all (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7)\npackage.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a `new Function('require', data.record.message)(require)` sink — arbitrary remote code execution on the installer's machine at npm install time, with `require` passed in for full Node capability. The package name is `vitest-preview-pro-all` but the shipped main is a copy of the nodemailer library (author 'Andris Reinman'), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.\n","affected":[{"package":{"ecosystem":"npm","name":"vitest-preview-pro-all"},"versions":["10.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"082583b62d90da834dc8e262f6999bcd2a1194e3ef3fefca8d70f6c1ebc4fa79","tlsh":"0b217819bf8427a1278759fb6a679874c223ec92f89c5d099076f0a43cd0924dbc3634"},{"path":"package.json","sha256":"430c5822c257b0ec5953460d9a65d03baa09d354a2fc5b7f529d89bccdfbc8a5","tlsh":"7841cc25cda78ce3229526ed6cac5183a564d44fcd06b80db34c634d4f8f95f327866d"}],"package_integrity":[{"filename":"vitest-preview-pro-all-10.0.3.tgz","hashes":{"sha1":"42cff168587c33d2128af71e8f2da1b88b0240d2","sha512_sri":"sha512-3mutGzGHYG22XX9IEfjMOKJXdTaxGF1uoKwLnT0dwUz2Lo1OGYClvVNyF99qxAqtD5Gc09QhtcQ/URALnf5ieQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vitest-preview-pro-all/v/10.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016097","import_time":"2026-08-06T13:08:49.014566047Z","modified_time":"2026-08-06T12:30:54Z","sha256":"ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7","source":"amazon-inspector","versions":["10.0.3"]}]}}