The 'vitest-agent' npm package (versions 1.0.5 and 1.0.6) includes a postinstall lifecycle script that spawns a detached Node.js child process executing code fetched dynamically from a remote URL. This code execution occurs without user interaction beyond installing the package. The package's source code is a verbatim copy of nodemailer but with misleading metadata and file structures designed to disguise its malicious behavior. The malicious payload fetches JavaScript from 'https://jsonkeeper.com/b/WDH3V' and executes it using 'new Function', allowing arbitrary code execution on the installer's machine. This results in a full compromise of any system where the package is installed.

Systems that install 'vitest-agent' versions 1.0.5 or 1.0.6 are fully compromised as the package executes arbitrary remote code during installation. This can lead to unauthorized access, data theft, and control over the affected machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removing the package alone may not eliminate all malicious components due to the potential for persistent backdoors or additional malware installed by the malicious code.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to immediately remove the 'vitest-agent' package versions 1.0.5 and 1.0.6 from all systems. Treat any system with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a separate, trusted environment. Avoid installing packages from untrusted or suspicious sources and verify package authenticity before installation.