{"answers":{"affected":"1 open source package ship an affected version, including vitest-chalk-pro.","exploited":"There is no known exploitation of MAL-2026-15563 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-15563 is a malicious package in vitest-chalk-pro, published on 29 Aug 2026."},"fix_prompt":"MAL-2026-15563 is a malicious package: vitest-chalk-pro (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-15563/ (Markdown: https://insights.sbomify.com/MAL-2026-15563/index.md)","id":"MAL-2026-15563","markdown":"https://insights.sbomify.com/MAL-2026-15563/index.md","name":"MAL-2026-15563","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"vitest-chalk-pro@10.0.7 declares a postinstall hook (node lib/utils/index.js) that spawns a detached, silenced child process running lib/utils/smtp-connection/index.js. That child uses axios to GET https://api.jsonbin.io/v3/b/6a62bc86da38895dfe879659 and passes the returned `cookie` field to `new Function('require',...)(require)`, executing attacker-controlled JavaScript on the installer's machine at every `npm install`. The fetched content is opaque and mutable — the operator of the jsonbin document can rotate the payload at any time. The child is spawned with `detached: true`, `stdio: ['ignore','ignore','ignore']`, and `unref()` so it continues running after npm install returns and produces no output. The package name suggests a vitest/chalk utility, but `main` is a verbatim copy of nodemailer's entrypoint (author metadata `Andris Reinman`, ETHEREAL_* environment variables, references to api.nodemailer.com), an unrelated facade that disguises the dropper.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in vitest-chalk-pro (npm)","id":"MAL-2026-15563","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"vitest-chalk-pro","purl":"pkg:npm/vitest-chalk-pro","source":"MAL-2026-15563"}],"products":null,"published":"2026-08-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-15563/"}