node-fastify@5.9.0

Analysis

Combosquatting campaign targeting the fastify web framework. Package name node-fastify mimics the legitimate fastify, published by nenethrosas who also owns the confirmed-malicious fastnodemailer. All versions (5.8.7–5.9.1) include child_process as an npm dependency and inject execSync calls in fastify.js to silently install and load fastnodemailer — the publisher's own malware package. Version 5.8.7 lists fastnodemailer as a direct dependency and runs execSync('npm i fastnodemailer') with output logged. Later versions (5.9.0–5.9.1) refined the payload to use silent install flags (--no-warnings --no-save --no-progress --loglevel silent) to avoid detection, and use a try/catch that first attempts require('fastnodemailer') before falling back to installation. This is a multi-stage supply-chain attack: the combosquat delivers a dropper that fetches the real payload (fastnodemailer) from npm on execution.