{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/utils/smtp-connection/index.js",
              "sha256": "082583b62d90da834dc8e262f6999bcd2a1194e3ef3fefca8d70f6c1ebc4fa79",
              "tlsh": "0b217819bf8427a1278759fb6a679874c223ec92f89c5d099076f0a43cd0924dbc3634"
            },
            {
              "path": "package.json",
              "sha256": "430c5822c257b0ec5953460d9a65d03baa09d354a2fc5b7f529d89bccdfbc8a5",
              "tlsh": "7841cc25cda78ce3229526ed6cac5183a564d44fcd06b80db34c634d4f8f95f327866d"
            }
          ],
          "package_integrity": [
            {
              "filename": "vitest-preview-pro-all-10.0.3.tgz",
              "hashes": {
                "sha1": "42cff168587c33d2128af71e8f2da1b88b0240d2",
                "sha512_sri": "sha512-3mutGzGHYG22XX9IEfjMOKJXdTaxGF1uoKwLnT0dwUz2Lo1OGYClvVNyF99qxAqtD5Gc09QhtcQ/URALnf5ieQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "vitest-preview-pro-all"
      },
      "versions": [
        "10.0.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016097",
        "import_time": "2026-08-06T13:08:49.014566047Z",
        "modified_time": "2026-08-06T12:30:54Z",
        "sha256": "ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7",
        "source": "amazon-inspector",
        "versions": [
          "10.0.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7)\npackage.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavily obfuscated with obfuscator.io-style hex-identifier string arrays hiding an axios GET to https://api.jsonbin.io/v3/b/6a719632da38895dfeb7128d and a `new Function(\u0027require\u0027, data.record.message)(require)` sink \u2014 arbitrary remote code execution on the installer\u0027s machine at npm install time, with `require` passed in for full Node capability. The package name is `vitest-preview-pro-all` but the shipped main is a copy of the nodemailer library (author \u0027Andris Reinman\u0027), an impersonation cover for the dropper. The jsonbin.io host is mutable, third-party, and attacker-controlled; the fetched payload is not pinned, hashed, or signed.\n",
  "id": "MAL-2026-13405",
  "modified": "2026-08-06T12:30:54Z",
  "published": "2026-08-06T12:30:54Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/vitest-preview-pro-all/v/10.0.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in vitest-preview-pro-all (npm)"
}