Malicious code in vitest-chalk-pro (npm)

The npm package [email protected] declares a postinstall hook that runs a detached, silenced child process executing lib/utils/smtp-connection/index.js. This child process uses axios to fetch a JSON document from https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659, extracting a 'cookie' field which is passed to a dynamically constructed Function that executes attacker-controlled JavaScript code. The fetched payload is opaque and mutable, allowing the attacker to rotate the malicious code at will. The child process is spawned with detached and ignored stdio settings, continuing to run silently after npm install completes. The package name suggests a vitest/chalk utility, but its main entrypoint is a copy of nodemailer's, serving as a facade to disguise the malicious dropper.

This malicious package enables arbitrary code execution on any machine where [email protected] is installed via npm. The attacker can remotely update the payload at any time, potentially leading to persistent compromise, data theft, or further malware deployment. The silent and detached execution makes detection difficult during installation.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and remove it if already installed. Verify package authenticity before installation and prefer official, well-maintained packages. Monitor for updates from the package maintainer or npm advisories for any remediation.