Malicious code in vitest-cli-pro (npm)

The vitest-cli-pro package (version 10.0.7) published on npm includes a postinstall script that runs lib/utils/index.js, which spawns a detached Node.js process executing lib/utils/smtp-connection/index.js. This script performs an HTTPS GET request to a mutable, attacker-controlled JSON bin at https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659, retrieves a 'cookie' value, and executes it immediately using new Function(require). This allows arbitrary JavaScript code execution on any system running 'npm install vitest-cli-pro', under the privileges of the installing user. The package uses the nodemailer code and the vitest-branded name as a cover to disguise its malicious behavior.

Any user who installs vitest-cli-pro version 10.0.7 may have arbitrary JavaScript code executed on their machine with their user privileges. This can lead to compromise of the user's environment, data theft, or further malware installation. The attack is triggered during package installation without additional user interaction.

No official patch or remediation is indicated in the provided data. Users should avoid installing vitest-cli-pro version 10.0.7. If already installed, remove the package and audit the system for potential compromise. Monitor the vendor advisory or npm security advisories for updates or official guidance. Since this is a malicious package, the best mitigation is to avoid using it altogether.