MAL-2026-15563
Dashboard / Malicious Package / MAL-2026-15563
MAL-2026-15563
Summary: Malicious code in vitest-chalk-pro (npm)
Details: Source: amazon-inspector (4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e) [email protected] declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `cookie` field to `new Function('require',...)(require)`, executing attacker-controlled JavaScript on the installer's machine at every `npm install`. The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `unref()` so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but `main` is a verbatim copy of nodemailer's entrypoint (author metadata `Andris Reinman`, ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.
Affected packages
Package
Name: vitest-chalk-pro
Purl: pkg:npm/vitest-chalk-pro
Affected ranges
Type: N/A
Events:
