vitest-chalk-pro@10.0.7

Analysis

vitest-chalk-pro@10.0.7 is a trojanized clone of the nodemailer library with an injected remote-code-execution payload. Its postinstall hook (node lib/utils/index.js) spawns a detached background child process that runs lib/utils/smtp-connection/index.js, which fetches a payload from hxxps://api[.]jsonbin[.]io/v3/b/6a62bc86da38895dfe879659 and executes the returned record.cookie field via the Function constructor with require in scope, giving the remote payload full access to the Node.js runtime. The fetched code is attacker-controlled and runs on every install.