vitest-preview-pro@10.0.3

Analysis

vitest-preview-pro@10.0.3 is a trojanized clone of the nodemailer package. Its preinstall hook (node lib/utils/index.js) spawns a detached background Node process running an obfuscated script at lib/utils/smtp-connection/index.js. That script uses a Function-constructor trick to obtain process and require, reads environment variables, and loads a large hex-encoded payload blob stored in lib/utils/smtp-connection/LICENSE (262KB, not a real license). The obfuscated loader constructs and executes further code from the embedded blob, making this a multi-stage dropper that runs on install.