MAL-2026-15870

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-cli-dev/MAL-2026-15870.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15870
Published
2026-09-04T02:57:36Z
Modified
2026-09-04T03:30:05.013233938Z
Summary
Malicious code in vitest-cli-dev (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953)

vitest-cli-dev@10.0.7 is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an install-time dropper. The declared postinstall runs lib/utils/index.js, which spawns a detached Node child process executing lib/utils/smtp-connection/index.js. That child fetches JSON from https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and https://api.jsonstorage.net/v1/json/5b343803-a7a8-4a86-ba58-2dd6116a18d4/1ba3d09f-292a-4cc2-a2bc-71e6c9ac98a5 and passes the returned 'cookie' field to new Function("require", data.cookie)(require), executing attacker-controlled JavaScript on the installer's machine at npm install time. The child is detached and unref'd, allowing it to survive npm's parent process. The remote JSON payloads are mutable and can be swapped by the attacker at any time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-09-04T03:21:35.794755879Z",
            "source": "amazon-inspector",
            "versions": [
                "10.0.7"
            ],
            "id": "IN-MAL-2026-019444",
            "modified_time": "2026-09-04T02:57:36Z",
            "sha256": "3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953"
        }
    ]
}
References
Credits

Affected packages

npm / vitest-cli-dev

Package

Name
vitest-cli-dev
View open source insights on deps.dev
Purl
pkg:npm/vitest-cli-dev

Affected ranges

Affected versions

10.*
10.0.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-cli-dev/MAL-2026-15870.json"
indicators 
{
    "evidence_files": [
        {
            "path": "lib/utils/smtp-connection/index.js",
            "tlsh": "80f09ee4329b76bd71f918c5a62a10095093db301e4df092b1887bf42da45de5fa1bf1",
            "sha256": "e74a28a4a1308f742da4d4d6d9017244ec6bd143bf9dc247997c53408af4f3cb"
        },
        {
            "path": "package.json",
            "tlsh": "42418815cda78ce3329925ed786c5283a461d00fcd0ab81d738d138c8f8ea5f327966d",
            "sha256": "57ac95d585bde9721caeb499a965cc35de9dedd61e218b3c37a0cba2f6bd7564"
        }
    ],
    "package_integrity": [
        {
            "filename": "vitest-cli-dev-10.0.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-QO2NAM3dmQYcwAi5nA1wGgZFWojj+VUkNOF4NUUpDu2KyAeiKoyFU4cdluSzTpJuCCRfzxiARWZF71jFQfnb3w==",
                "sha1": "1cb6b2edfb0a0f07f75a80b8b38e9afc1e3aed90"
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]