vitest-pro

{"modified":"2026-06-16T18:12:14Z","published":"2026-06-16T03:02:30Z","schema_version":"1.7.4","id":"MAL-2026-5862","summary":"Malicious code in vitest-pro (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (39810890a1ffc946b3da439738fb619eab1613a775a308d6f248b80b38ce5603)\nPackage `vitest-pro` is a namespace-abuse lure: its name suggests a vitest extension, but its source tree, README, and `main` entry (`lib/nodemailer.js`) are a verbatim copy of nodemailer with the name string rewritten. `package.json` declares `\"postinstall\": \"node lib/utils/index.js\"`, which on `npm install` spawns `lib/utils/smtp-connection/index.js` as a detached child process (`spawn(process.execPath, [filePath], {detached:true, stdio:['ignore','ignore','ignore']})`). That file is heavily obfuscated with two stacked layers (a custom base-91-style decoder populating a string cache, plus an obfuscator.io string-array with `_0x...` identifiers); once decoded it loads `axios` and `child_process`, polls a hardcoded C2 at `74.0.48.37:4556` and `74.0.48.37:4558`, downloads a ZIP, extracts it via `tar` / `Expand-Archive` / `unzip`, and executes the dropped binary. It then establishes cross-platform persistence: on Windows it writes to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` via `reg.exe add`, registers a `schtasks /create... /sc ONLOGON` task, and drops a startup `.cmd` under `%APPDATA%\\...\\Startup`; on macOS it writes a LaunchAgent plist under `~/Library/LaunchAgents` and runs `launchctl load`. Any developer or CI system running `npm install vitest-pro` is compromised at install time and re-compromised on every reboot.\n","affected":[{"package":{"ecosystem":"npm","name":"vitest-pro"},"versions":["7.0.5","7.0.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/utils/smtp-connection/index.js","sha256":"fd8a11b1e8794a9797651780bf9113e8d4c6aa173db64bad8e0da123ee4fccb0","tlsh":"d3837d80d0c3ffe9e95d11e92526a50dec314ca193c87a8c6247f96afdb4d9613f8788"},{"path":"package.json","sha256":"5e99d02bd9a8c9dd3ae861fb426c4ff9577a5d7fc9918467f9cd0e275262c58a","tlsh":"1541a815cda78ce3229929ed686c5183b420d10fcc4ab81d734c538c4f8e99f32b8a6d"}],"package_integrity":[{"filename":"vitest-pro-7.0.5.tgz","hashes":{"sha1":"46650f0bfeae3364d0734a105ef0ac3f2e01dbe4","sha512_sri":"sha512-Qpv0DoBgJKsuL7GsB74mW1IzLYvmyxByh8fd3anPLH/5z/VfhC8hMHT2Yyo70byHOklUAvjNjgyMYiFDSrwdzw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/vitest-pro/v/7.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/vitest-pro/v/7.0.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","sha256":"39810890a1ffc946b3da439738fb619eab1613a775a308d6f248b80b38ce5603","import_time":"2026-06-16T03:49:20.247226529Z","id":"IN-MAL-2026-006746","modified_time":"2026-06-16T03:02:30Z","versions":["7.0.5"]},{"source":"amazon-inspector","sha256":"cc8568cd583ad77ec3c2c57d671c8ac9f846381d8ce31a3413185fa6e8b33a6c","import_time":"2026-06-16T18:10:19.867395463Z","id":"IN-MAL-2026-006779","modified_time":"2026-06-16T16:14:35Z","versions":["7.0.6"]}]}}