The 'vitest-preview-pro' npm package versions 10.0.3, 10.0.5, 10.0.6, and 10.0.7 are malicious. The package contains a preinstall script that runs a detached child process executing obfuscated JavaScript code. This code fetches a JSON payload from api.jsonbin.io, a public and mutable JSON hosting service, and executes the 'record.cookie' field as JavaScript with full require privileges during installation. The package's advertised purpose is a Vitest preview utility, but it actually contains a rebranded nodemailer library with an added dropper. Additionally, a large hex-encoded binary blob is included as a staged secondary payload disguised as a license file. This setup allows attackers to dynamically change the payload delivered to victims at install time.

Users installing affected versions of 'vitest-preview-pro' are at risk of arbitrary code execution during package installation. The attacker-controlled payload executes with full Node.js require access, enabling potential compromise of the host system, installation of additional malware, data exfiltration, or other malicious activities. The use of a public, mutable JSON hosting service for payload delivery means the malicious code can be updated dynamically, increasing the threat's persistence and adaptability.

No official patch or remediation guidance is provided in the available data. Users should immediately avoid installing or using 'vitest-preview-pro' versions 10.0.3, 10.0.5, 10.0.6, and 10.0.7. Remove these versions from any systems where they are installed. Consider auditing your environment for signs of compromise if these versions were used. Monitor official npm advisories or the package maintainer for updates or removal of the malicious package. Until a fix or official guidance is available, do not trust or use this package.