eslint-plugin-vitest-ts @1.0.4

Summary

The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader. package.json's postinstall hook runs node lib/utils/index.js , which spawns a detached child process executing lib/utils/smtp-connection/index.js. That file uses obfuscator.io-style string-array indirection ( _0x438c , _0x926305 , etc.) to hide a call that fetches JSON from https://api.jsonbin.io/v3/b/6a72aa2bda38895dfebb1302 and passes the returned record.cookie string to new Function('require', <fetched>)(require) . The fetched content is attacker-controlled and mutable, and it executes in-process with require injected, giving arbitrary code execution on any machine that runs npm install for this package. The name eslint-plugin-vitest-ts is unrelated to the shipped nodemailer-shaped source, indicating a lure/typosquat.

Source: amazon-inspector (a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3)