Malicious code in vitest-cli-dev (npm)

The vitest-cli-dev package version 10.0.7 is a typosquat package whose name and homepage mimic a legitimate vitest tool. Its tarball includes nodemailer and a postinstall script that runs lib/utils/index.js, which spawns a detached Node.js child process executing lib/utils/smtp-connection/index.js. This child process fetches JSON data from two remote URLs and executes the 'cookie' field content as JavaScript via new Function, passing the require function to it. This allows arbitrary attacker-controlled code execution on the machine at npm install time. The detached child process is unreferenced, allowing it to continue running independently of the npm process. The remote JSON payloads are mutable, meaning the attacker can change the executed code at any time after installation.

This vulnerability enables arbitrary code execution on the installer's machine during npm install, potentially leading to full system compromise. Because the malicious code runs detached and independently, it can persist beyond the installation process. The attacker can dynamically update the malicious payloads remotely, increasing the risk and flexibility of exploitation.

No official patch or remediation is currently documented. Users should avoid installing the vitest-cli-dev package version 10.0.7. Verify package authenticity before installation, especially for similarly named packages. Consider using trusted package registries and tools that detect typosquatting or malicious packages. Monitor for updates from the package maintainers or npm security advisories for any official fixes.