vitest-cli-pro

{"modified":"2026-09-02T03:58:15Z","published":"2026-09-02T03:58:15Z","schema_version":"1.7.4","id":"MAL-2026-15818","summary":"Malicious code in vitest-cli-pro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2)\nPackage published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `record.cookie` value to `new Function(require)` for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing `npm install vitest-cli-pro`, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"vitest-cli-pro"},"versions":["10.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"e96ebeb43c6f0eda1f353dbeed62ab183db5922adcc6a0f95c4f7521b6535f3a","tlsh":"0dd0a78432a6656e21fa2585562620095053c6304d48f052b18467f11c504da6e61bf1"},{"path":"package.json","sha256":"8f91eeb10dabdf03252690318ad0db3d54d251c964bcd2921300ca6ceeb9bb1e","tlsh":"71418515cd678ce3369929ed68685183a460d00fcd0ab81d735c928c4f8e99f32b866d"}],"package_integrity":[{"filename":"vitest-cli-pro-10.0.7.tgz","hashes":{"sha1":"6c24cf1d7d0c5b447dd66ac34fc06e510562f278","sha512_sri":"sha512-U/M3O3fM07/9te6I+cQ/gllqeZHorV5oYZYQLErVYaDk0Y227C5Os756NprgSgpQufZ3dEHbsFbMH0etKYRDsQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vitest-cli-pro/v/10.0.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019332","import_time":"2026-09-02T04:23:33.740461563Z","modified_time":"2026-09-02T03:58:15Z","sha256":"1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2","source":"amazon-inspector","versions":["10.0.7"]}]}}