MAL-2026-13405

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-preview-pro-all/MAL-2026-13405.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13405
Published
2026-08-06T12:30:54Z
Modified
2026-08-06T13:34:48.577530562Z
Summary
Malicious code in vitest-preview-pro-all (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7)

package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a new Function('require', data.record.message)(require) sink — arbitrary remote code execution on the installer's machine at npm install time, with require passed in for full Node capability. The package name is vitest-preview-pro-all but the shipped main is a copy of the nodemailer library (author 'Andris Reinman'), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7",
            "versions": [
                "10.0.3"
            ],
            "import_time": "2026-08-06T13:08:49.014566047Z",
            "id": "IN-MAL-2026-016097",
            "modified_time": "2026-08-06T12:30:54Z"
        }
    ]
}
References
Credits

Affected packages

npm / vitest-preview-pro-all

Package

Name
vitest-preview-pro-all
View open source insights on deps.dev
Purl
pkg:npm/vitest-preview-pro-all

Affected ranges

Affected versions

10.*
10.0.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "42cff168587c33d2128af71e8f2da1b88b0240d2",
                "sha512_sri": "sha512-3mutGzGHYG22XX9IEfjMOKJXdTaxGF1uoKwLnT0dwUz2Lo1OGYClvVNyF99qxAqtD5Gc09QhtcQ/URALnf5ieQ=="
            },
            "filename": "vitest-preview-pro-all-10.0.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0b217819bf8427a1278759fb6a679874c223ec92f89c5d099076f0a43cd0924dbc3634",
            "path": "lib/utils/smtp-connection/index.js",
            "sha256": "082583b62d90da834dc8e262f6999bcd2a1194e3ef3fefca8d70f6c1ebc4fa79"
        },
        {
            "path": "package.json",
            "sha256": "430c5822c257b0ec5953460d9a65d03baa09d354a2fc5b7f529d89bccdfbc8a5",
            "tlsh": "7841cc25cda78ce3229526ed6cac5183a564d44fcd06b80db34c634d4f8f95f327866d"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-preview-pro-all/MAL-2026-13405.json"