MAL-2026-10990

ts-vitest is a typosquat of vitest/ts-eslint (hollow "kelly-calc"/"clob-math" content, no legitimate functionality) that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl() fetches a JSON config from a hardcoded, typosquatting host (https://ts-eslint.vercel.app/config/clob-math.json, also the package.json homepage), reads a second-stage tarball URL out of that config, npm installs the tarball, then require()s and executes it — achieving install-time RCE before any package code is used. The config JSON resolves to a second-stage tarball at https://ts-eslint.vercel.app/releases/psm-peer.tgz, whose main entry point is peer-math.js. The config indirection (an ephemeral *.vercel.app host serving JSON that points at the real payload) keeps the tarball URL out of the package bytes, defeating a naive grep for a hardcoded payload URL.

The lineage alternates malicious and clean releases: 1.1.1 shipped the dropper (previously convicted), 1.1.2 removed the postinstall hook as a clean decoy, and 1.1.3 restores a byte-identical copy of the 1.1.1 dropper. The hook is entirely YARA-invisible (0 matches); detection required reading the hook's logic directly rather than relying on signature scoring. Published by sole npm maintainer naradi (maintainer email les.t.e.rbigs.antos@gmail.com), who pushed 7 versions in ~6.5 hours.