vitest-agent@1.0.5

Analysis

vitest-agent@1.0.5 is a combosquat of the vitest test runner, shipping a trojanized copy of the nodemailer library. The postinstall hook (node lib/utils/index.js) spawns a detached child process running lib/utils/smtp-connection/index.js, which fetches a second-stage payload from hxxps://jsonkeeper[.]com/b/UTUUE and executes it via new Function("require", ...). The payload URL is resolved at install time and the fetched code runs with full access to the installer's Node.js environment.