Description

package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a new Function('require', data.record.message)(require) sink — arbitrary remote code execution on the installer's machine at npm install time, with require passed in for full Node capability. The package name is vitest-preview-pro-all but the shipped main is a copy of the nodemailer library (author 'Andris Reinman'), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.

Mitigation

Aliases