MAL-2026-5862

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-pro/MAL-2026-5862.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5862
Published
2026-06-16T03:02:30Z
Modified
2026-06-16T18:16:52Z
Summary
Malicious code in vitest-pro (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (39810890a1ffc946b3da439738fb619eab1613a775a308d6f248b80b38ce5603)

Package vitest-pro is a namespace-abuse lure: its name suggests a vitest extension, but its source tree, README, and main entry (lib/nodemailer.js) are a verbatim copy of nodemailer with the name string rewritten. package.json declares "postinstall": "node lib/utils/index.js", which on npm install spawns lib/utils/smtp-connection/index.js as a detached child process (spawn(process.execPath, [filePath], {detached:true, stdio:['ignore','ignore','ignore']})). That file is heavily obfuscated with two stacked layers (a custom base-91-style decoder populating a string cache, plus an obfuscator.io string-array with _0x... identifiers); once decoded it loads axios and child_process, polls a hardcoded C2 at 74.0.48.37:4556 and 74.0.48.37:4558, downloads a ZIP, extracts it via tar / Expand-Archive / unzip, and executes the dropped binary. It then establishes cross-platform persistence: on Windows it writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run via reg.exe add, registers a schtasks /create... /sc ONLOGON task, and drops a startup .cmd under %APPDATA%\...\Startup; on macOS it writes a LaunchAgent plist under ~/Library/LaunchAgents and runs launchctl load. Any developer or CI system running npm install vitest-pro is compromised at install time and re-compromised on every reboot.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-006746",
            "import_time": "2026-06-16T03:49:20.247226529Z",
            "modified_time": "2026-06-16T03:02:30Z",
            "sha256": "39810890a1ffc946b3da439738fb619eab1613a775a308d6f248b80b38ce5603",
            "source": "amazon-inspector",
            "versions": [
                "7.0.5"
            ]
        },
        {
            "id": "IN-MAL-2026-006779",
            "import_time": "2026-06-16T18:10:19.867395463Z",
            "modified_time": "2026-06-16T16:14:35Z",
            "sha256": "cc8568cd583ad77ec3c2c57d671c8ac9f846381d8ce31a3413185fa6e8b33a6c",
            "source": "amazon-inspector",
            "versions": [
                "7.0.6"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / vitest-pro

Package

Name
vitest-pro
View open source insights on deps.dev
Purl
pkg:npm/vitest-pro

Affected ranges

Affected versions

7.*
7.0.5
7.0.6

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/utils/smtp-connection/index.js",
            "sha256": "fd8a11b1e8794a9797651780bf9113e8d4c6aa173db64bad8e0da123ee4fccb0",
            "tlsh": "d3837d80d0c3ffe9e95d11e92526a50dec314ca193c87a8c6247f96afdb4d9613f8788"
        },
        {
            "path": "package.json",
            "sha256": "5e99d02bd9a8c9dd3ae861fb426c4ff9577a5d7fc9918467f9cd0e275262c58a",
            "tlsh": "1541a815cda78ce3229929ed686c5183b420d10fcc4ab81d734c538c4f8e99f32b8a6d"
        }
    ],
    "package_integrity": [
        {
            "filename": "vitest-pro-7.0.5.tgz",
            "hashes": {
                "sha1": "46650f0bfeae3364d0734a105ef0ac3f2e01dbe4",
                "sha512_sri": "sha512-Qpv0DoBgJKsuL7GsB74mW1IzLYvmyxByh8fd3anPLH/5z/VfhC8hMHT2Yyo70byHOklUAvjNjgyMYiFDSrwdzw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/vitest-pro/MAL-2026-5862.json"