MAL-2026-12004

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-preview-pro/MAL-2026-12004.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12004
Published
2026-08-04T23:56:52Z
Modified
2026-08-07T13:21:01.813946923Z
Summary
Malicious code in vitest-preview-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075)

The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added preinstall dropper. package.json declares preinstall: node lib/utils/index.js, which uses child_process.spawn(process.execPath, [lib/utils/smtp-connection/index.js], {detached:true, stdio:['ignore','ignore','ignore']}).unref() to launch a detached, fully silenced child that survives beyond npm install. The spawned file is obfuscated with a custom basE91 string-array decoder; the decoded top-level async IIFE calls globalThis.fetch against a URL on api.jsonbin.io/v3/, parses the JSON response, and passes the record.cookie field to new Function('require', body)(require), executing attacker-controlled JavaScript with full require access on the installer at install time. api.jsonbin.io is a public, mutable, anonymous JSON-hosting service, so the executed payload can change at any time. Adjacent to the loader, lib/utils/smtp-connection/LICENSE is a 262KB file whose contents are a hex-encoded ~131KB opaque binary blob rather than license text, colocated with the loader as a staged secondary payload. The advertised package purpose has no relationship to the shipped SMTP source, providing cover for the injected dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T00:04:38.603696929Z",
            "versions": [
                "10.0.3"
            ],
            "modified_time": "2026-08-04T23:56:52Z",
            "source": "amazon-inspector",
            "sha256": "367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075",
            "id": "IN-MAL-2026-011358"
        },
        {
            "import_time": "2026-08-07T12:23:25.236362389Z",
            "versions": [
                "10.0.7"
            ],
            "modified_time": "2026-08-07T12:10:28Z",
            "source": "amazon-inspector",
            "sha256": "89c5df9061ae735cf633cb37fd2dacf7d296adcac7301ec30b469f85df81c953",
            "id": "IN-MAL-2026-016873"
        },
        {
            "import_time": "2026-08-07T12:51:22.367271191Z",
            "versions": [
                "10.0.5"
            ],
            "id": "IN-MAL-2026-017017",
            "source": "amazon-inspector",
            "sha256": "232406b380ab6265da42e7031cf963ef260b438633ab80d232f0dae1e79f7a3c",
            "modified_time": "2026-08-07T12:31:44Z"
        },
        {
            "import_time": "2026-08-07T12:51:22.486662022Z",
            "versions": [
                "10.0.6"
            ],
            "modified_time": "2026-08-07T12:32:10Z",
            "source": "amazon-inspector",
            "sha256": "a357f5333e94520bd0b1dec295d11b8058127be567534a43e63e8366fd47b838",
            "id": "IN-MAL-2026-017020"
        }
    ]
}
References
Credits

Affected packages

npm / vitest-preview-pro

Package

Name
vitest-preview-pro
View open source insights on deps.dev
Purl
pkg:npm/vitest-preview-pro

Affected ranges

Affected versions

10.*
10.0.3
10.0.5
10.0.6
10.0.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "path": "lib/utils/smtp-connection/index.js",
            "sha256": "a87db3e13de1d1d06dfefc156e1a745cbeea5c2d1866340196150fd2bfefda88",
            "tlsh": "864164ca99c23e5ce1dd64a5cd3d29277714c99768cc10d2c6f28b5478dc6d583ec518"
        },
        {
            "path": "lib/utils/index.js",
            "sha256": "9fb27c30f484650bb4a39f65a03fbccdc0b9b5f1cb84700ca73ee8893c66e06e",
            "tlsh": "dae0686a23533738a034cbc1da30ce3b258b8020b365a0e0f00c406a2bc72c406ea8da"
        },
        {
            "path": "lib/utils/smtp-connection/LICENSE",
            "sha256": "78922197a1b55502112c7dfe1c456b242bcace75b5d19213c191f666a1209e4b",
            "tlsh": "c744bfbc76047de6267f575bd997aded036626239acba4cd80647bc304b3371ee02809"
        },
        {
            "tlsh": "cb41b925cda78ce7229525ed6cac9183b560d54fcd06b80db34c524c4f8e95f317866d",
            "sha256": "cba5adda71f0b4ec111270f96960a31c447e912379185d082f78a09b77234ff1",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "b91f0103a110a40ea23ba9150eb80acf63bda516",
                "sha512_sri": "sha512-e+kxvvJpfgBQKrbOcX6p72OJ4o016GAMr2nr+Iy/DC63nlsnigXJ9A+VSP2pBFM3gbjVuDfQZY3quzVjGFaIvg=="
            },
            "filename": "vitest-preview-pro-10.0.3.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-preview-pro/MAL-2026-12004.json"
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]