The npm package 'vitest-preview-pro-all' version 10.0.3 contains malicious code that executes arbitrary remote code during installation. Its postinstall script runs obfuscated JavaScript which fetches and executes attacker-controlled code from a mutable third-party source. The package impersonates the legitimate 'nodemailer' library to disguise its malicious intent.