vitest-chalk-pro @10.0.7

Summary

vitest-chalk-pro@10.0.7 declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned cookie field to new Function('require',...)(require) , executing attacker-controlled JavaScript on the installer's machine at every npm install . The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with detached: true , stdio: ['ignore','ignore','ignore'] , and unref() so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but main is a verbatim copy of nodemailer's entrypoint (author metadata Andris Reinman , ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.

Source: amazon-inspector (4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e)