vitest-cli-pro@10.0.7

Summary

Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned record.cookie value to new Function(require) for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing npm install vitest-cli-pro, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper.

Source: amazon-inspector (1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2)