The 'vitest-preview-pro-all' npm package (version 10.0.3) includes a postinstall script that runs 'lib/utils/index.js', which spawns a detached Node.js child process executing heavily obfuscated code in 'lib/utils/smtp-connection/index.js'. This code performs an axios GET request to a mutable, attacker-controlled URL on jsonbin.io and then executes the fetched payload using a 'new Function' call with 'require' passed in, enabling full Node.js capability and arbitrary remote code execution on the machine installing the package. The package's main file is a copy of the legitimate 'nodemailer' library, used as a cover for the malicious dropper. The fetched payload is not pinned, hashed, or signed, allowing the attacker to change the code at will.

An attacker can execute arbitrary code with full Node.js privileges on any system that installs the affected package version, potentially leading to complete system compromise. The malicious payload is remotely controlled and can be changed at any time, increasing the risk and unpredictability of the attack. This affects the security and integrity of the installation environment.

No official patch or remediation is currently documented. Users should avoid installing version 10.0.3 of 'vitest-preview-pro-all'. Verify package authenticity before installation and prefer official, trusted sources. Monitor for updates from the package maintainer or npm security advisories for any forthcoming fixes. Consider removing the package if already installed.