vitest-pro@7.0.4

Analysis

vitest-pro combosquats the popular vitest testing framework. The postinstall hook spawns a detached background process that connects to a hardcoded C2 server on port 4556 with a heartbeat every 30 seconds. The implant downloads, extracts, and executes remote binary payloads (HTTP GET from the C2), establishes persistence via Windows scheduled tasks and Startup folder .vbs scripts, macOS launchd plists, and Linux autostart .desktop entries, and checks whether it is running with administrative/elevated privileges (schtasks, sc query). The malicious code is heavily obfuscated with javascript-obfuscator and disguised within a legitimate Nodemailer codebase under lib/utils/smtp-connection/index.js.0.4 to appear established.