vitest-cli@1.0.0

Analysis

vitest-cli@1.0.0 is a combosquat on the legitimate vitest testing framework. Its postinstall hook activates an obfuscated downloader in lib/postinstall/index.js that fetches a remote payload from hxxps://jsonkeeper[.]com/b/W33XO and executes it via new Function(), giving the attacker arbitrary code execution on the installer's system. The payload retries up to 3 times with 10-minute intervals. No credentials or environment variables are exfiltrated — the attack vector is remote second-stage payload execution.