MAL-2026-15563

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4718de971af33ad02b8945e1b981e30d1decbf9c7d1006f37a641cd822156f0e)

vitest-chalk-pro@10.0.7 declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned cookie field to new Function('require',...)(require), executing attacker-controlled JavaScript on the installer's machine at every npm install. The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with detached: true, stdio: ['ignore','ignore','ignore'], and unref() so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but main is a verbatim copy of nodemailer's entrypoint (author metadata Andris Reinman, ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.