GCVE-110-OSM-2026-11543

Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a child Node process to execute lib/utils/smtp-connection/index.js. That file performs an HTTPS GET to a jsonbin.io endpoint and passes the returned `record.cookie` value to `new Function(require)` for immediate execution. The JSON bin is attacker-controlled and mutable, so arbitrary JavaScript runs on any machine executing `npm install vitest-cli-pro`, under the installer's user account. The nodemailer main and the vitest-branded name serve as a cover story for the dropper. ENTRY lib/utils/index.js (install-hook: node lib/utils/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/fetch/index.js: "Buffer.from(parsed.auth).toString('base64')" - Data Encoding for Exfiltration in lib/mime-funcs/index.js: "EncodeURIComponent(chr" - Data Encoding for Exfiltration in lib/smtp-connection/http-proxy-client.js: "Buffer.from(proxy.auth).toString('base64')" - Data Encoding for Exfiltration in lib/smtp-connection/index.js: "Buffer.from( //this._auth.user+'\u0000'+ '\u0000' + // skip authorization identi..." - Payload Download from Paste Service in lib/utils/smtp-connection/index.js: "jsonbin.io" - DNS Lookup in lib/mailer/index.js: "dns.resolve(" - DNS Lookup in lib/shared/index.js: "dns.lookup(" - System Information Collection in lib/smtp-connection/index.js: "os.hostname()" OBFUSCATION - Dynamic Base64 Decoding in lib/shared/index.js: "Buffer.from(data, 'base64')" - Dynamic Base64 Decoding in lib/smtp-connection/index.js: "Buffer.from(challengeString, 'base64')" - Strings Extracted from Deobfuscated Code in lib/shared/index.js - Strings Extracted from Deobfuscated Code in lib/smtp-connection/index.js ADDITIONAL FINDINGS - Suspicious TLD Domain in lib/nodemailer.js: "https://ethereal.email" - Shell Command Execution in lib/sendmail-transport/index.js: "child_process').spawn" - Detached Child Process Payload in lib/utils/index.js: "spawn(process.execPath, [filePath], { detached: true" - Very New NPM Publisher Account PAYLOAD FILES lib/smtp-connection/index.js (+ lib/shared/index.js)