vitest-cli-pro@10.0.7

Analysis

vitest-cli-pro@10.0.7 is a trojanized clone of the nodemailer library. Its postinstall hook (node lib/utils/index.js) spawns a detached background process that runs lib/utils/smtp-connection/index.js, which performs an HTTP GET to hxxps://api[.]jsonbin[.]io/v3/b/6a62bc86da38895dfe879659 and executes the returned record.cookie value via new Function("require", ...) with full require access — a remote second-stage payload download-and-execute at install time. The C2/staging endpoint is api[.]jsonbin[.]io (bin 6a62bc86da38895dfe879659).