The eslint-plugin-vitest-ts npm package version 1.0.4 declares itself as an ESLint plugin but ships with obfuscated code resembling nodemailer's source layout. Its postinstall script runs a node process that executes obfuscated code which fetches JSON data from a remote URL. The fetched data includes a 'record.cookie' string that is executed as JavaScript code with require injected, allowing attacker-controlled arbitrary code execution during npm install. The package name is unrelated to the shipped code, indicating a typosquatting attempt to lure victims.

Any system running npm install on eslint-plugin-vitest-ts version 1.0.4 is vulnerable to arbitrary code execution due to the malicious postinstall script. This can lead to full compromise of the affected machine, data theft, or further malware deployment. The attacker controls the remote payload, allowing dynamic and potentially evolving malicious behavior.

No official patch or remediation is currently documented. Users should avoid installing eslint-plugin-vitest-ts version 1.0.4. Verify package authenticity before installation and prefer official, well-maintained packages. Monitor for updates from the package maintainer or npm advisories for remediation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.