MAL-2026-13405

    Dashboard / Malicious Package / MAL-2026-13405

    MAL-2026-13405

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in vitest-preview-pro-all (npm)

    Details: Source: amazon-inspector (ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7) package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a `new Function('require', data.record.message)(require)` sink — arbitrary remote code execution on the installer's machine at npm install time, with `require` passed in for full Node capability. The package name is `vitest-preview-pro-all` but the shipped main is a copy of the nodemailer library (author 'Andris Reinman'), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.

    References: https://www.npmjs.com/package/vitest-preview-pro-all/v/10.0.3

    Affected packages

    Package

    Name: vitest-preview-pro-all

    Purl: pkg:npm/vitest-preview-pro-all

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.3
    MAL-2026-13405 | CVE-DB