MAL-2026-15870

    Dashboard / Malicious Package / MAL-2026-15870

    MAL-2026-15870

    Published: 4 Sept 2026Last Modified: 4 Sept 2026

    Summary: Malicious code in vitest-cli-dev (npm)

    Details: Source: amazon-inspector (3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953) [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an install-time dropper. The declared postinstall runs lib/utils/index.js, which spawns a detached Node child process executing lib/utils/smtp-connection/index.js. That child fetches JSON from https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and https://api.jsonstorage.net/v1/json/5b343803-a7a8-4a86-ba58-2dd6116a18d4/1ba3d09f-292a-4cc2-a2bc-71e6c9ac98a5 and passes the returned 'cookie' field to new Function("require", data.cookie)(require), executing attacker-controlled JavaScript on the installer's machine at npm install time. The child is detached and unref'd, allowing it to survive npm's parent process. The remote JSON payloads are mutable and can be swapped by the attacker at any time.

    References: https://www.npmjs.com/package/vitest-cli-dev/v/10.0.7

    Affected packages

    Package

    Name: vitest-cli-dev

    Purl: pkg:npm/vitest-cli-dev

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    10.0.7