MAL-2026-15563 Malicious code in vitest-chalk-pro (npm)

[email protected] declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned cookie field to new Function('require',...)(require), executing attacker-controlled JavaScript on the installer's machine at every npm install. The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with detached: true, stdio: ['ignore','ignore','ignore'], and unref() so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but main is a verbatim copy of nodemailer's entrypoint (author metadata Andris Reinman, ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.