GCVE-110-OSM-2026-11638

vitest-cli-dev@10.0.7 is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an install-time dropper. The declared postinstall runs lib/utils/index.js, which spawns a detached Node child process executing lib/utils/smtp-connection/index.js. That child fetches JSON from https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and https://api.jsonstorage.net/v1/json/5b343803-a7a8-4a86-ba58-2dd6116a18d4/1ba3d09f-292a-4cc2-a2bc-71e6c9ac98a5 and passes the returned 'cookie' field to new Function("require", data.cookie)(require), executing attacker-controlled JavaScript on the installer's machine at npm install time. The child is detached and unref'd, allowing it to survive npm's parent process. The remote JSON payloads are mutable and can be swapped by the attacker at any time. ENTRY lib/utils/index.js (install-hook: node lib/utils/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - 5 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/fetch/index.js: "Buffer.from(parsed.auth).toString('base64')" - Data Encoding for Exfiltration in lib/mime-funcs/index.js: "EncodeURIComponent(chr" - Data Encoding for Exfiltration in lib/smtp-connection/http-proxy-client.js: "Buffer.from(proxy.auth).toString('base64')" - Data Encoding for Exfiltration in lib/smtp-connection/index.js: "Buffer.from( //this._auth.user+'\u0000'+ '\u0000' + // skip authorization identi..." - Payload Download from Paste Service in lib/utils/smtp-connection/index.js: "jsonbin.io" - DNS Lookup in lib/mailer/index.js: "dns.resolve(" - DNS Lookup in lib/shared/index.js: "dns.lookup(" - System Information Collection in lib/smtp-connection/index.js: "os.hostname()" OBFUSCATION - Dynamic Base64 Decoding in lib/shared/index.js: "Buffer.from(data, 'base64')" - Dynamic Base64 Decoding in lib/smtp-connection/index.js: "Buffer.from(challengeString, 'base64')" - Strings Extracted from Deobfuscated Code in lib/shared/index.js - Strings Extracted from Deobfuscated Code in lib/smtp-connection/index.js ADDITIONAL FINDINGS - Suspicious TLD Domain in lib/nodemailer.js: "https://ethereal.email" - Shell Command Execution in lib/sendmail-transport/index.js: "child_process').spawn" - Detached Child Process Payload in lib/utils/index.js: "spawn(process.execPath, [filePath], { detached: true" - Very New NPM Publisher Account PAYLOAD FILES lib/smtp-connection/index.js (+ lib/shared/index.js)