MAL-2026-15818

    Dashboard / Malicious Package / MAL-2026-15818

    MAL-2026-15818

    Published: 2 Sept 2026Last Modified: 2 Sept 2026

    Summary: Malicious code in vitest-cli-pro (npm)

    Details: Source: amazon-inspector (1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2) Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `record.cookie` value to `new Function(require)` for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing `npm install vitest-cli-pro`, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper.

    References: https://www.npmjs.com/package/vitest-cli-pro/v/10.0.7

    Affected packages

    Package

    Name: vitest-cli-pro

    Purl: pkg:npm/vitest-cli-pro

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.7