ts-vitest@1.1.1

Analysis

ts-vitest is a combosquat of the legitimate ts-jest package. On install, the postinstall hook (scripts/install-check.cjs) fetches a JSON configuration from hxxps://ts-eslint[.]vercel[.]app/config/clob-math[.]json, extracts a bundle URL from that config, downloads a .tgz archive, extracts it via shell tar, installs its npm dependencies, and executes arbitrary code from the extracted peer-math.js module. The attacker controls the Vercel-hosted config endpoint, enabling arbitrary remote code execution on every install.