eslint-plugin-vitest-ts@1.0.4

Analysis

eslint-plugin-vitest-ts@1.0.4 is a trojanized clone of the nodemailer library. Its postinstall hook runs lib/utils/index.js, which spawns a detached background Node process executing an obfuscated script (lib/utils/smtp-connection/index.js). That script fetches a remote payload from hxxps://api[.]jsonbin[.]io/v3/b/6a72aa2bda38895dfebb1302, reads the JSON response's "record.cookie" field, and executes it as code via new Function('require', ...)(require) — a remote-code-execution dropper. The package also ships an AES-256-CBC decryption helper (lib/utils/smtp-connection/parse.js) with a hardcoded key and IV, and two 262KB hex-encrypted payload blobs disguised as LICENSE files (package/LICENSE and package/lib/utils/smtp-connection/LICENSE). Installing this package executes remote attacker-controlled code on the victim machine.