Malicious code in vitest-preview-pro (npm)
vitest-preview-pro, an npm package masquerading as a Vitest preview utility, contained malicious code: a preinstall script that spawns a detached child process executing obfuscated JavaScript fetched from api.jsonbin.io/v3/, enabling arbitrary code execution with full require access at install time. A secondary hex-encoded binary payload was staged in the LICENSE file.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed vitest-preview-pro during the malicious publication window.
- Ecosystems
- Attack vectors
- Affected entities
- vitest-preview-proMalicious npm package with preinstall dropper and obfuscated payload loader
The npm package vitest-preview-pro was published with a misleading name suggesting it provides Vitest preview functionality, but contained a rebranded copy of nodemailer with injected malicious code. The package.json declared a preinstall hook (preinstall: node lib/utils/index.js) that executed during installation.
The preinstall script used child_process.spawn() to launch a detached, fully silenced child process that persisted beyond the npm install completion. The spawned process executed obfuscated code from lib/utils/smtp-connection/index.js, which was encoded using a custom base91 string-array decoder.
Once decoded, the payload performed a fetch request to api.jsonbin.io/v3/ (a public, mutable, anonymous JSON-hosting service), parsed the JSON response, and executed the record.cookie field as arbitrary JavaScript via new Function('require', body)(require). This granted the attacker full Node.js require access on the installer's machine at install time.
A secondary payload was staged as a 262KB hex-encoded binary blob in lib/utils/smtp-connection/LICENSE, disguised as license text. The mismatch between the advertised package purpose (Vitest preview utility) and the shipped SMTP source code provided cover for the injected dropper.
Indicators of compromise
- Packages
- vitest-preview-pro
- Domains
- api.jsonbin.io
Remediation
- Immediately uninstall vitest-preview-pro from all systems where it was installed
- Audit npm install logs and package-lock.json to identify when and where vitest-preview-pro was installed
- Review system logs and process execution history on affected machines for signs of the detached child process or secondary payload execution
- Regenerate any credentials, API keys, or secrets that may have been exposed during the install window
- Update npm to the latest version and run `npm audit` to identify other potentially compromised dependencies
- Consider using npm package integrity verification tools and private package registries to prevent similar attacks
- Monitor api.jsonbin.io for any associated payloads or attacker infrastructure
Sources
- GitHub Advisory GHSA-68vm-3fp7-p29j · GitHub Advisory Database
Cite this entry
"Malicious code in vitest-preview-pro (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-vitest-preview-pro-npm-1iu3kb
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malicious code in akamaijs-sensor (npm)
The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.
npmCompromised packageMalicious commit